From a2ceb0a522c2ab6452fda1d6e7b975eaa224d1d9 Mon Sep 17 00:00:00 2001 From: Ronald Tse Date: Sun, 25 Oct 2026 19:05:23 +0800 Subject: [PATCH] =?UTF-8?q?fix(release):=20job-level=20permissions=20?= =?UTF-8?q?=E2=80=94=20step-level=20id-token=20made=20the=20file=20invalid?= =?UTF-8?q?,=20so=20the=20tag=20run=20never=20executed=20the=20real=20work?= =?UTF-8?q?flow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/release.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 444b14e2..18705ca9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,9 @@ jobs: # monorepo's ruby/ tree — the v3.2.0 gem therefore did not contain # this repo's decode fixes (512-step cap, UTF-8 scrub). runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v7 @@ -38,7 +41,5 @@ jobs: - name: Publish to rubygems.org (trusted publishing) # Org law: OIDC trusted publishing, never API-key tokens. Requires # the one-time rubygems.org trusted-publisher registration for - # this repo + workflow. - permissions: - id-token: write + # this repo + workflow (confirmed registered 2026-10-25). uses: rubygems/release-gem@v1