ci: improvement permissions

oxc-project · Dec 12, 2024 · 6d04c06 · 6d04c06
1 parent 17441f8
commit 6d04c06
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
@@ -6,10 +6,6 @@ on:
     branches:
       - main
 
-permissions:
-  pull-requests: write
-  contents: write
-
 jobs:
   release-plz:
     name: Release-plz
@@ -18,6 +14,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ secrets.OXC_BOT_PAT }}
 
       - uses: Boshen/setup-rust@main
         with:
@@ -27,19 +24,26 @@ jobs:
       - name: Run release-plz
         id: release-plz
         uses: MarcoIeni/release-plz-action@v0.5
+        permissions:
+          pull-requests: write
+          contents: write
         env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OXC_BOT_PAT }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
       - name: Bump package.json
         if: ${{ steps.release-plz.outputs.prs_created }}
+        permissions:
+          pull-requests: write
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.OXC_BOT_PAT }}
           RELEASES: ${{ steps.release-plz.outputs.releases }}
           PR: ${{ steps.release-plz.outputs.pr }}
         run: |
           set -e
 
+          echo $RELEASES
+
           pr_number=${{ fromJSON(steps.release-plz.outputs.pr).number }}
           if [[ -n "$pr_number" ]]; then
             version=$(echo "$RELEASES" | jq -r '.[0].version')