From b97dadbcbea69e2cc6864e93ac0eb19c3dd90776 Mon Sep 17 00:00:00 2001 From: Kristian Myram Date: Fri, 30 Oct 2026 21:28:16 +0100 Subject: [PATCH] docs(release): clarify contributor refresh caller permissions --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index be9b132..28a94fb 100644 --- a/README.md +++ b/README.md @@ -68,9 +68,15 @@ jobs: #### Automatic contributor credits (opt-in) Apps with `scripts/refresh-contributors.py` can refresh bundled credits once before a release. -Call the read-only preparatory workflow, then pass its output to the release workflow: +Grant the caller workflow `contents: write` for release publishing, and keep the preparatory +`credits` job read-only with its job-level override. A called workflow cannot increase the +token permissions granted by its caller; see [reusable-workflow permissions](https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#supported-keywords-for-jobs-that-call-a-reusable-workflow). +Call the preparatory workflow, then pass its output to the release workflow: ```yaml +permissions: + contents: write + jobs: credits: permissions: