Walkthrough

The release workflow now explicitly defines GitHub Actions permission scopes. A top-level permissions: {} removes default token permissions. The build and build-wasm jobs receive read-only access via permissions: { contents: read }, while the release job gets write access with permissions: { contents: write }. The release step's authentication environment variable changes from GITHUB_TOKEN to GH_TOKEN using github.token.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• Resolve excessive-permissions warning in ci.yaml #7547: Implements similar GitHub Actions workflow permission scope refinements (permissions: { contents: read } and contents: write) to follow principle of least privilege.

Suggested reviewers

• youknowone

Poem

🐰 Permissions tightened, like a burrow in spring,
Each job gets exactly what it needs to bring,
No excess tokens hopping about wild and free,
Just the right access—secure as can be! ✨

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn