From 13764853abe9882eacad8826a88e1dc6c39cf899 Mon Sep 17 00:00:00 2001
From: mintaka <mintaka@rigel.build>
Date: Thu, 15 Oct 2026 14:29:21 -0400
Subject: [PATCH] ci(release): grant the mint token workflows write

GitHub returns 403 on tag creation when the target commit's workflow
tree matches no branch tip, unless the token has workflows write. Add it
next to contents write, and pin the exact permission set in the release
tag test.

Refs RIG-5434

Co-authored-by: Matt Wilkinson <matt@rigel.build>
---
 .github/scripts/release-tag.test.sh | 11 +++++++++++
 .github/workflows/release-tag.yaml  |  1 +
 2 files changed, 12 insertions(+)

diff --git a/.github/scripts/release-tag.test.sh b/.github/scripts/release-tag.test.sh
index 337db7c..425944a 100755
--- a/.github/scripts/release-tag.test.sh
+++ b/.github/scripts/release-tag.test.sh
@@ -172,4 +172,15 @@ else
   fails=$((fails + 1))
 fi
 
+# workflows: write lets GitHub create a tag at a commit whose workflow tree matches no branch tip.
+token='.jobs.mint.steps[] | select(.name == "Create scoped release App token") | .with'
+if [ "$(yq -r "$token | keys | map(select(test(\"^permission-\"))) | sort | join(\",\")" "$workflow")" = permission-contents,permission-workflows ] \
+  && [ "$(yq -r "$token | .\"permission-contents\"" "$workflow")" = write ] \
+  && [ "$(yq -r "$token | .\"permission-workflows\"" "$workflow")" = write ]; then
+  echo 'ok   mint token has contents and workflows write only'
+else
+  echo 'FAIL mint token has contents and workflows write only'
+  fails=$((fails + 1))
+fi
+
 [ "$fails" -eq 0 ]
diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index 2d70813..19e4226 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -52,6 +52,7 @@ jobs:
           client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
           private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
           permission-contents: write
+          permission-workflows: write
           repositories: nix2container
 
       - name: Mint release tag if needed