From 46260fd6a66d649b7e6f8052c8d334e2a76d946b Mon Sep 17 00:00:00 2001
From: Kathryn Baldauf <k_baldauf@apple.com>
Date: Thu, 5 Jun 2025 20:28:08 -0700
Subject: [PATCH] Move permissions in release and add id-token (#24)

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
---
 .github/workflows/release.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 96d0014d..66f1be58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,11 +5,6 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
-permissions:
-  contents: read
-  packages: write
-  pages: write
-
 jobs: 
   containerization:
     uses: ./.github/workflows/containerization-build-template.yml
@@ -17,9 +12,17 @@ jobs:
       release: true
       version: ${{ github.ref_name }}
     secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      pages: write
   deployDocs:
     runs-on: ubuntu-latest
     needs: containerization
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}