Repository navigation
ci: grant release job contents: write for asset upload (SEC-842) - #596
Draft
Matt Sutkus (msuitcase) wants to merge 3 commits into
Draft
Matt Sutkus (msuitcase) wants to merge 3 commits into
Matt Sutkus (msuitcase) wants to merge 3 commits into
Conversation
… entries Fixes GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp in @vitest/mocker. Lockfile only; package.json ranges are unchanged. Removes GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx from audit-ci.jsonc, which audit-ci reports as no longer matching anything.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Why
#586 added a workflow-level
permissions: contents: readtorelease.yml. TheUpload assets to releasestep (AButler/upload-release-assets) callsrepos.uploadReleaseAsset, which needscontents: write. No release has run since #586: the last one (v9.0.0-rc.1, 2026-09-08) predates it and gotContents: writefrom the repo default. The next release would publish to npm, then fail the upload with a 403 and leave the release withouteasypost.js/easypost.mjs.Change
permissionsblock.permissionson thereleasejob instead:id-token: write(npm trusted publishing) andcontents: write(asset upload).Related: #592 (
ci.ymlleast-privilege permissions).Part of SEC-842.
Testing
release.ymlonly runs on a published release orworkflow_dispatch, so this PR's CI does not exercise it. Verify on the next release thatUpload assets to releasesucceeds and the release shows both assets.Pull Request Type