From 4485811185b600415ea4db42544c996ce7f91ec0 Mon Sep 17 00:00:00 2001
From: Lucas Nogueira <lucas@tauri.app>
Date: Mon, 2 Feb 2026 15:18:56 -0300
Subject: [PATCH] entire workflow permissions

---
 .github/workflows/publish-cli-js.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-cli-js.yml b/.github/workflows/publish-cli-js.yml
index 4aa05069c..3e4f76081 100644
--- a/.github/workflows/publish-cli-js.yml
+++ b/.github/workflows/publish-cli-js.yml
@@ -20,6 +20,10 @@ defaults:
   run:
     working-directory: packages/cli/
 
+permissions:
+  contents: write # update release
+  id-token: write # oidc token
+
 jobs:
   build:
     strategy:
@@ -366,9 +370,6 @@ jobs:
       - test-linux-x64-gnu-binding
       - test-linux-x64-musl-binding
       #- test-linux-arm-bindings
-    permissions:
-      contents: write # update release
-      id-token: write # oidc token
     steps:
       - uses: actions/checkout@v4
       - run: npm i -g --force corepack