From 465dacbfd61ec43c51fc8310da5f0ac1ca62904d Mon Sep 17 00:00:00 2001 From: Manfred Riem Date: Tue, 16 Jun 2026 07:36:56 -0500 Subject: [PATCH] fix: add contents:read to build job, clarify manual publish - Build job needs contents:read for checkout (job-level perms replace workflow-level) - Clarify that PyPI publishing is manually triggered, not automatic Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/publish-pypi.yml | 1 + .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 6cedde684..c59ca9f79 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -15,6 +15,7 @@ jobs: build: runs-on: ubuntu-latest permissions: + contents: read actions: write steps: - name: Checkout release tag diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a22c7c34b..b86ff5124 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,7 +82,7 @@ jobs: uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION} \`\`\` - > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above. + > **Note:** PyPI publishing is triggered manually after this release. If the PyPI version is not yet available, use the source install command above. NOTES_EOF