scoped permission

xataio · Jul 16, 2024 · 240ff75 · 240ff75
1 parent b32c17f
commit 240ff75
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/release-cli-assets.yml b/.github/workflows/release-cli-assets.yml
@@ -33,9 +33,6 @@ on:
         type: string
         default: 'latest'
 
-permissions:
-  id-token: write
-
 jobs:
   release-cli-assets:
     name: Release CLI assets
@@ -110,6 +107,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Configure AWS Credentials for production
+        permissions:
+          id-token: write
+          contents: read
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: ${{ secrets.CLI_ASSETS_UPLOAD_ROLE }}