[ci] Fix missing permissions for prereleases (#32729)
Missed these earlier. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32729). * __->__ #32729 * #32728
lauren committed
Mar 24, 2025 at 18:24 UTC
ee0855f427832e899767f7659c5289364218ab9e
3 files changed
+15
.github/workflows/runtime_prereleases.yml
+3
@@ -29,6 +29,9 @@ jobs:
29
publish_prerelease:
30
name: Publish prelease (${{ inputs.release_channel }}) ${{ inputs.commit_sha }} @${{ inputs.dist_tag }}
31
runs-on: ubuntu-latest
32
+ permissions:
33
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
34
+ actions: read
35
steps:
36
- uses: actions/checkout@v4
37
- uses: actions/setup-node@v4
.github/workflows/runtime_prereleases_manual.yml
+6
@@ -16,6 +16,9 @@ jobs:
16
publish_prerelease_canary:
17
name: Publish to Canary channel
18
uses: facebook/react/.github/workflows/runtime_prereleases.yml@main
19
+ permissions:
20
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
21
+ actions: read
22
with:
23
commit_sha: ${{ inputs.prerelease_commit_sha }}
24
release_channel: stable
@@ -36,6 +39,9 @@ jobs:
39
publish_prerelease_experimental:
40
name: Publish to Experimental channel
41
uses: facebook/react/.github/workflows/runtime_prereleases.yml@main
42
+ permissions:
43
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
44
+ actions: read
45
# NOTE: Intentionally running these jobs sequentially because npm
46
# will sometimes fail if you try to concurrently publish two
47
# different versions of the same package, even if they use different
.github/workflows/runtime_prereleases_nightly.yml
+6
@@ -14,6 +14,9 @@ jobs:
14
publish_prerelease_canary:
15
name: Publish to Canary channel
16
uses: facebook/react/.github/workflows/runtime_prereleases.yml@main
17
+ permissions:
18
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
19
+ actions: read
20
with:
21
commit_sha: ${{ github.sha }}
22
release_channel: stable
@@ -24,6 +27,9 @@ jobs:
27
publish_prerelease_experimental:
28
name: Publish to Experimental channel
29
uses: facebook/react/.github/workflows/runtime_prereleases.yml@main
30
+ permissions:
31
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
32
+ actions: read
33
# NOTE: Intentionally running these jobs sequentially because npm
34
# will sometimes fail if you try to concurrently publish two
35
# different versions of the same package, even if they use different