fix(release-please): set explicit token permissions

.github/workflows/release-please.yml

@@ -8,10 +8,7 @@ on:
       RELEASE_PLEASE_PRIVATE_KEY:
         required: true
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
@@ -23,6 +20,9 @@ jobs:
         with:
           client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}"
           private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Run release-please
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:

release-please/README.md

@@ -62,18 +62,15 @@ _Or with predefined versions:_
 
 ## 2. ⚙️ Usage in Your Repository
 
-Place the following YAML file (e.g., `.github/workflows/release.yml`) in your repository to directly call the reusable workflow. It triggers the workflow on a push to the `main` branch, applies the necessary permissions, and inherits secrets.
+Place the following YAML file (e.g., `.github/workflows/release.yml`) in your repository to directly call the reusable workflow. It triggers the workflow on a push to the `main` branch and inherits secrets. No `GITHUB_TOKEN` permission is needed (see [2.1. Token Scope](#21-token-scope)).
 
 ```yaml
 on:
   push:
     branches:
       - main
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 name: release-please
 
@@ -83,6 +80,26 @@ jobs:
     secrets: inherit
 ```
 
+### 2.1. Token Scope
+
+The workflow does not use the `GITHUB_TOKEN`. It authenticates as a GitHub App with the `RELEASE_PLEASE_APPLICATION_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets, because [events created with the `GITHUB_TOKEN` do not trigger new workflow runs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow): CI would not run on release PRs, and release tags would not trigger publish workflows.
+
+The App installation token is:
+
+- **Short-lived:**  
+  It expires after one hour.
+
+- **Limited to the calling repository:**  
+  It only grants access to the repository running the workflow.
+
+- **Restricted to the permissions release-please needs:**  
+  Even if the App itself is granted more, the token only carries:
+  - `contents: write` to push the release branch and create tags and releases;
+  - `pull-requests: write` to open and update the release PR;
+  - `issues: write` to label and comment on the release PR.
+
+The App must be granted at least these permissions on the repository.
+
 ## 3. Release Types
 
 **release-please** supports different release types tailored for various ecosystems and languages via the `release-type` parameter in the configuration file. Here are some of the common ones:

release-please/workflow-sha256

@@ -1 +1 @@
-1d9d54064d8a10354bfc6a5429a13770b9e185c82fb0a116ed2abc3ceb8dbbf7
+92300e2292f4c1e2431a1313c968f2a96b91dd320dea13f2586ddd0c570fadbe