From 43a2bed1c07a78ed143b9fb85a704076739f4ef7 Mon Sep 17 00:00:00 2001
From: Andrew Gable <andrew@expensify.com>
Date: Mon, 27 Oct 2025 16:54:53 -0600
Subject: [PATCH] Add permissions for OIDC in publish.yml

Added permissions for id-token and contents in the publish workflow.
---
 .github/workflows/publish.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 881a28a..bdbbd38 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [main]
 
+permissions:
+  id-token: write  # Required for OIDC: https://docs.npmjs.com/trusted-publishers
+  contents: read
+
 # Ensure that only one instance of this workflow executes at a time.
 # If multiple PRs are merged in quick succession, there will only ever be one publish workflow running and one pending.
 concurrency: ${{ github.workflow }}