ci(patch-release): support trusted publishers for package publish (#899)

huxuan · web-flow · commit 73eed5762725 · 2025-01-31T21:29:06.000+08:00
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -118,6 +118,9 @@ jobs:
           - '3.13'
   package-publish:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/template/{% if repo_platform == 'github' %}.github{% endif %}/workflows/release.yml.jinja b/template/{% if repo_platform == 'github' %}.github{% endif %}/workflows/release.yml.jinja
@@ -129,6 +129,9 @@ jobs:
 {% endif %}
   package-publish:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
