From 19495a7d985b3d20950c870e94ebd57a9c2b2bcd Mon Sep 17 00:00:00 2001 From: hugo8xx Date: Tue, 25 Aug 2026 08:39:26 +0700 Subject: [PATCH] fix(ci): publish needs contents: read to check out the repo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Naming any permission on a job REPLACES the default set, so id-token: write on its own left the job without contents: read. actions/checkout then failed with remote: Repository not found. fatal: repository 'https://github.com/khwanlabs/khwan-mcp/' not found which reads like the repository is gone rather than like a missing scope, and only happens on a private one — a public repo checks out without it, which is why this passed on the first package and failed on the next. Fixed in all three so the same release does not have to be diagnosed twice. --- .github/workflows/publish.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ec8a2d9..2118df1 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,7 +17,12 @@ jobs: runs-on: ubuntu-latest environment: pypi permissions: - # Required for OIDC. Nothing else is, and nothing else is granted. + # Naming any permission REPLACES the default set, so contents: read has to + # be asked for — without it actions/checkout cannot read a private + # repository and fails with "Repository not found", which reads like the + # repo is gone rather than like a missing scope. + contents: read + # OIDC, which is what removes the need for an API token. id-token: write steps: - uses: actions/checkout@v4