Restrict GitHub Actions workflow permissions to least privilege by jedisct1 · Pull Request #1718 · fastly/cli

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 · 2026-04-07T12:49:35Z

Change summary

By default, the GITHUB_TOKEN in Github actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised.

This change adds explicit permissions blocks to all five workflows, restricting the default token to contents: read only.

Workflows that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations, so they don't need write access on the default token.

The only exception is the NPM release workflow, which additionally needs packages: write to publish to GitHub Packages.

All Submissions:

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

User Impact

None. This only affects CI workflow permissions and does not change any CLI behavior.

Are there any considerations that need to be addressed for release?

None.

By default, the GITHUB_TOKEN in Actions workflows has broad read-write access, which is a security risk if a workflow or any of its third-party actions is compromised. All five workflows in this repo only need read access to repository contents through the default token, since the ones that publish releases or push commits already use dedicated PATs or GitHub App tokens for those operations. The only exception is the NPM release workflow, which additionally needs packages:write to publish to GitHub Packages.

philippschulte

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

jedisct1 · 2026-04-07T14:50:37Z

Hi Philipp,

This looks mostly good but I am not sure if removing id-token: write in publish_release.yml may break the release workflow if it relies on OIDC anywhere.

The workflow doesn't seem to use OIDC anywhere. It authenticates to npm via a token from setup-node and to GitHub Packages via GITHUB_TOKEN.

I don't think id-token is used by any step.

philippschulte

Thank you!

### Change summary This PR restores a permission in the workflow that had been removed in #1718 that is needed for publishing to NPM. Publishing to NPM using trusted publishing requires `id-token: write` as added in #1644. ### New Feature Submissions: * [x] Does your submission pass tests? ### Changes to Core Features: * [ ] Have you written new tests for your core changes, as applicable? * [ ] Have you successfully run tests with your changes locally? ### Are there any considerations that need to be addressed for release? A new point release (14.3.1) would be needed to get this version into NPM.

* main: build(deps): bump the go-dependencies group with 5 updates (fastly#1726) release 14.3.1 (fastly#1725) Restore permission for trusted publishing (fastly#1724) Release 14.3.0 (fastly#1723) [CDTOOL-1193] Support for Logging Endpoint Errors (fastly#1721) chore(deps): bump go-fastly to 14.2.0 (fastly#1722) Add --json / -j flag to all stats subcommands (fastly#1719) build(deps): bump the go-dependencies group with 4 updates (fastly#1720) Add "auth revoke" subcommand for token revocation (fastly#1717) Restrict GitHub Actions workflow permissions to least privilege (fastly#1718)

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

jedisct1 requested a review from a team as a code owner April 7, 2026 12:49

jedisct1 requested a review from philippschulte April 7, 2026 12:49

jedisct1 added the Skip-Changelog do not add a changelog entry for this change label Apr 7, 2026

philippschulte reviewed Apr 7, 2026
View reviewed changes

Comment thread.github/workflows/publish_release.yml

philippschulte requested changes Apr 7, 2026
View reviewed changes

Merge branch 'main' into fdenis/perms
297382c

philippschulte approved these changes Apr 7, 2026
View reviewed changes

jedisct1 enabled auto-merge (squash) April 8, 2026 14:56

jedisct1 merged commit 4df24bb into mainApr 8, 2026
13 checks passed

jedisct1 deleted the fdenis/perms branch April 8, 2026 15:09

harmony7 mentioned this pull request Apr 11, 2026
Restore permission for trusted publishing #1724
Merged
3 tasks

Uh oh!

Conversation

jedisct1 commented Apr 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

User Impact

Are there any considerations that need to be addressed for release?

Uh oh!

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

jedisct1 commented Apr 7, 2026

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jedisct1 commented Apr 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

User Impact

Are there any considerations that need to be addressed for release?

Uh oh!

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

jedisct1 commented Apr 7, 2026

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jedisct1 commented Apr 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

User Impact

Are there any considerations that need to be addressed for release?

Uh oh!

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

jedisct1 commented Apr 7, 2026

Uh oh!

philippschulte left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jedisct1 commented Apr 7, 2026•
edited
Loading

jedisct1 commented Apr 7, 2026•
edited
Loading

jedisct1 commented Apr 7, 2026•
edited
Loading

jedisct1 commented Apr 7, 2026•
edited
Loading

jedisct1 commented Apr 7, 2026•
edited
Loading