From a7cf4b4a54705a918de15795adc32d761824b914 Mon Sep 17 00:00:00 2001 From: Michael Assaf Date: Tue, 16 Jun 2026 15:29:23 -0400 Subject: [PATCH] fix(ci): publish-npm permissions must not exceed the caller The reusable publish-npm job requested contents:read, but cargo-dist's custom-publish-npm caller grants only {id-token, packages}, so contents is none. A reusable workflow cannot request more than its caller, which made the whole release workflow fail at startup. Drop contents:read and keep just id-token:write (a valid subset; checkout works at contents:none like publish-crates). --- .github/workflows/publish-npm.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 198f0bd..32a4c56 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -29,10 +29,12 @@ jobs: publish-npm: runs-on: ubuntu-latest # id-token: write is required in BOTH the caller (release.yml) and here for - # npm OIDC trusted publishing. + # npm OIDC trusted publishing. Only id-token — the caller (cargo-dist's + # custom-publish-npm) grants {id-token, packages}, so requesting `contents` + # here would EXCEED the caller and fail workflow validation at startup. + # checkout works at contents:none (same as the publish-crates job). permissions: id-token: write - contents: read steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2