From 4ab060a6038bd5f23b3d7cdccab6b438487d353c Mon Sep 17 00:00:00 2001
From: Stefan Steiner <ssteiner@tableau.com>
Date: Tue, 16 Jun 2026 01:25:22 -0700
Subject: [PATCH] fix(ci): grant contents:write to release publish job

The workflow-level `permissions: contents: read` (added in #147) blocks
`softprops/action-gh-release` from creating the GitHub Release. Add a
job-level override on the `publish` job so it can write releases while
the `verify` job stays read-only.
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 120405c..dcaaefc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -140,6 +140,8 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v6
         with: