remove permissions unrequired

elastic · Oct 23, 2024 · a6da3bf · a6da3bf
1 parent 617c0e0
commit a6da3bf
Showing 1 changed file with 6 additions and 8 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -5,8 +5,7 @@ on:
     types: [published]
 
 permissions:
-  contents: write
-  issues: write
+  contents: read
 
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
@@ -162,16 +161,10 @@ jobs:
     needs: [ 'release-windows']
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GIT_TAG: v${{ needs.release-windows.outputs.agent-version }}
       NEW_BRANCH: update/${{ needs.release-windows.outputs.agent-version }}
       TARGET_BRANCH: ${{ needs.release-windows.outputs.major-version }}.x
-
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
       - name: Get token
         id: get_token
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
@@ -186,6 +179,11 @@ jobs:
           repositories: >-
             ["apm-agent-dotnet"]
 
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.get_token.outputs.token }}
+
       - name: Setup git config
         uses: elastic/oblt-actions/git/setup@v1
         with: