From 6fe497d28c140ed160b72f4d2af75b7864cc8463 Mon Sep 17 00:00:00 2001
From: Mai TXN <maitxn@github.com>
Date: Wed, 10 Jun 2026 13:31:08 -0700
Subject: [PATCH 1/2] [version bump] handlebars

---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 43db284..5cacd73 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4548,9 +4548,9 @@
       "license": "MIT"
     },
     "node_modules/handlebars": {
-      "version": "4.7.8",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
-      "integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+      "version": "4.7.9",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

From ddea4374704289edbe11ae9d05504967e84062c6 Mon Sep 17 00:00:00 2001
From: Mai TXN <maitxn@github.com>
Date: Wed, 10 Jun 2026 14:59:09 -0700
Subject: [PATCH 2/2] ci: grant deployments:write permission to test and deploy
 jobs

Fixes 403 'Resource not accessible by integration' when the delete-all
step invalidates deployments. GITHUB_TOKEN defaulted to read-only, so
POST /deployments/:id/statuses was rejected.
---
 .github/workflows/deploy.yml | 3 +++
 .github/workflows/test.yml   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c2c2882..ad9e620 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      deployments: write
+      contents: read
     steps:
     - uses: actions/checkout@v4
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9404060..8aa31f3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,6 +19,9 @@ jobs:
         npm run all
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    permissions:
+      deployments: write
+      contents: read
     steps:
     - uses: actions/checkout@v4
     - uses: ./