Main => Prod

[dor-eitan]

No description provided.

To fix the problem, add a permissions block to the workflow to explicitly restrict the permissions granted to the GITHUB_TOKEN. The best way is to add the block at the root level of the workflow file, so it applies to all jobs unless overridden. For this workflow, the minimal required permission is likely contents: read, as the workflow checks out code and uploads artifacts but does not push changes or create pull requests. Add the following block after the name: and before the on: section:

permissions:
  contents: read

No additional imports, methods, or definitions are needed. Only a single block of YAML needs to be inserted.

To fix the problem, add a permissions block to the workflow file. This can be done at the root level (applies to all jobs) or at the job level (applies only to the specific job). Since there is only one job in this workflow, either approach is valid, but the root-level block is preferred for clarity and future extensibility. The minimal starting point is contents: read, which allows the workflow to read repository contents but not write to them. If the workflow requires additional permissions (e.g., to upload artifacts, interact with issues, or pull requests), those should be added explicitly. In this case, the workflow uploads artifacts but does not require write access to repository contents, so contents: read is sufficient.

Add the following block after the name: and before the on: section:

permissions:
  contents: read

No additional imports or dependencies are required.

The fix is to add an explicit permissions block to the workflow, in accordance with best practice. This can be added either at the workflow root (so it applies to all jobs) or to the specific jobs that need different permissions. Since there is only one job in this workflow (e2e-validation), adding the block at the top level is the simplest and most effective solution and will cause all jobs to only allow read access to repository contents via GITHUB_TOKEN. If a job needs a specific write permission (e.g., for pull-requests, issues, etc.), additional scopes may be added as needed, but for this workflow, the minimal { contents: read } is recommended as a starting point. The change consists of inserting the following at the top level under the workflow name:

permissions:
  contents: read

This should be added after the name: key and before the on: block, specifically as line 2 in the file.

To fix the problem, add a permissions block to the workflow to explicitly specify the minimum required permissions for the GITHUB_TOKEN. This can be done at the workflow root (applies to all jobs) or at the job level (applies to a specific job). The workflow needs to push commits/tags, create releases, and open pull requests, so it requires contents: write and pull-requests: write. It is best to set these at the workflow root for clarity and maintainability, unless some jobs require different permissions. The change should be made at the top level of .github/workflows/publish-on-merge.yml, immediately after the name: line and before the on: block.

---