From 21a7d899bfdfb387cae0c319a02392ebc6e57cc9 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:24:36 +0100 Subject: [PATCH 1/9] Remove permissions from release workflow Removed permissions section from release workflow. Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 837a0fbc79..4d97b4bd43 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,8 +14,6 @@ name: Release run-name: Release ${{ inputs.tag }} -permissions: - contents: read on: workflow_dispatch: inputs: From c32732476c8666c78e6cb15f386e4d47c6ba0993 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:27:03 +0100 Subject: [PATCH 2/9] Adding more permissions Add permissions for PR and PR Target jobs in release workflow. Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4d97b4bd43..954365bf7c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,10 +32,19 @@ jobs: pr: name: PR uses: ./.github/workflows/on-pr.yml + permissions: + pull-requests: write + contents: read pr-target: name: PR Target uses: ./.github/workflows/on-pr-target.yml + permissions: + contents: write + pages: write + pull-requests: write + id-token: write + actions: read create-release: name: Create release From 8639da8cbb563a5b4742de920af5e4ca6106ee4b Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:29:00 +0100 Subject: [PATCH 3/9] removing unused permission Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/on-pr-target.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/on-pr-target.yml b/.github/workflows/on-pr-target.yml index ecaa6b62f0..de9d2d85dc 100644 --- a/.github/workflows/on-pr-target.yml +++ b/.github/workflows/on-pr-target.yml @@ -28,7 +28,6 @@ on: permissions: pull-requests: write - issues: write jobs: qnx-build: From 75d4ded07cc9a5dbc6fd28cc8d57d8784cc745d5 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:30:41 +0100 Subject: [PATCH 4/9] Add permissions for issues in release workflow Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 954365bf7c..b1ab2d66f7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,6 +54,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + issues: write env: COVERAGE_ARCHIVE: ${{ github.event.repository.name }}-${{ inputs.tag }}-coverage steps: From 944019efb2669571c5b035f7ede97d13765e06ba Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:32:03 +0100 Subject: [PATCH 5/9] Update permissions in release workflow Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b1ab2d66f7..3a70ad382a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,6 +45,7 @@ jobs: pull-requests: write id-token: write actions: read + issues: write create-release: name: Create release @@ -54,7 +55,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - issues: write env: COVERAGE_ARCHIVE: ${{ github.event.repository.name }}-${{ inputs.tag }}-coverage steps: From 2470054c969afdb0764e85504236d7107d2a5473 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:32:26 +0100 Subject: [PATCH 6/9] Add write permissions for issues in workflow Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/on-pr-target.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/on-pr-target.yml b/.github/workflows/on-pr-target.yml index de9d2d85dc..ecaa6b62f0 100644 --- a/.github/workflows/on-pr-target.yml +++ b/.github/workflows/on-pr-target.yml @@ -28,6 +28,7 @@ on: permissions: pull-requests: write + issues: write jobs: qnx-build: From 01111aa881cc2bd84058004699540477c7f0f3e3 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:36:42 +0100 Subject: [PATCH 7/9] Inherit secrets in PR Target workflow Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3a70ad382a..685fcc7152 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,6 +39,7 @@ jobs: pr-target: name: PR Target uses: ./.github/workflows/on-pr-target.yml + secrets: inherit permissions: contents: write pages: write From bad4368ab44f523e313c42f33501f22cc55743ad Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski Date: Thu, 27 Aug 2026 11:56:54 +0100 Subject: [PATCH 8/9] Fixing format --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 685fcc7152..fe89069259 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,8 +33,8 @@ jobs: name: PR uses: ./.github/workflows/on-pr.yml permissions: - pull-requests: write - contents: read + pull-requests: write + contents: read pr-target: name: PR Target From 8bc995cc42f180f08699f9ff67eab83927869eb9 Mon Sep 17 00:00:00 2001 From: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> Date: Thu, 27 Aug 2026 12:19:35 +0100 Subject: [PATCH 9/9] Update runner to use ubuntu-latest in release workflow Signed-off-by: Maciej Kaszynski <161459353+MaciejKaszynski@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fe89069259..0686bb1619 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,7 +53,7 @@ jobs: needs: - pr - pr-target - runs-on: ubuntu-slim + runs-on: ubuntu-latest permissions: contents: write env: