From 52671d889c289ecf417516a1c94df58930caa3fb Mon Sep 17 00:00:00 2001
From: EarthCow <56940983+EarthCow@users.noreply.github.com>
Date: Sat, 30 May 2026 20:14:39 -0400
Subject: [PATCH 1/4] Add publish to Modrinth workflow

---
 .github/workflows/publish-modrinth.yml | 35 ++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/publish-modrinth.yml

diff --git a/.github/workflows/publish-modrinth.yml b/.github/workflows/publish-modrinth.yml
new file mode 100644
index 0000000..0ebf124
--- /dev/null
+++ b/.github/workflows/publish-modrinth.yml
@@ -0,0 +1,35 @@
+name: Publish to Modrinth
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Build with Gradle
+        run: ./gradlew build
+
+      - name: Publish to Modrinth
+        uses: cloudnode-pro/modrinth-publish@v2
+        with:
+          token: ${{ secrets.MODRINTH_TOKEN }}
+          project: ${{ secrets.MODRINTH_PROJECT_ID }}
+          version: ${{ github.event.release.tag_name }}
+          changelog: ${{ github.event.release.body }}
+          loaders: |-
+            velocity
+            bungeecord
+          game-versions: ">=1.8"
+          files: build/libs/*.jar
\ No newline at end of file

From d95bd5099fad554a652500bfc6adf7595c1ffee1 Mon Sep 17 00:00:00 2001
From: EarthCow <56940983+EarthCow@users.noreply.github.com>
Date: Sat, 30 May 2026 20:28:46 -0400
Subject: [PATCH 2/4] Disallow persist-credentials on checkout

---
 .github/workflows/publish-modrinth.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish-modrinth.yml b/.github/workflows/publish-modrinth.yml
index 0ebf124..f2bd992 100644
--- a/.github/workflows/publish-modrinth.yml
+++ b/.github/workflows/publish-modrinth.yml
@@ -11,6 +11,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
         uses: actions/setup-java@v4

From 27be75d2066d359182d56a11067856f37dca59e1 Mon Sep 17 00:00:00 2001
From: EarthCow <56940983+EarthCow@users.noreply.github.com>
Date: Sat, 30 May 2026 20:29:28 -0400
Subject: [PATCH 3/4] Use vars instead of secrets for MODRINTH_PROJECT_ID

---
 .github/workflows/publish-modrinth.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-modrinth.yml b/.github/workflows/publish-modrinth.yml
index f2bd992..c5a4e57 100644
--- a/.github/workflows/publish-modrinth.yml
+++ b/.github/workflows/publish-modrinth.yml
@@ -27,7 +27,7 @@ jobs:
         uses: cloudnode-pro/modrinth-publish@v2
         with:
           token: ${{ secrets.MODRINTH_TOKEN }}
-          project: ${{ secrets.MODRINTH_PROJECT_ID }}
+          project: ${{ vars.MODRINTH_PROJECT_ID }}
           version: ${{ github.event.release.tag_name }}
           changelog: ${{ github.event.release.body }}
           loaders: |-

From 5fc126a412be23d1ff6543967039596f4c5d0dab Mon Sep 17 00:00:00 2001
From: EarthCow <56940983+EarthCow@users.noreply.github.com>
Date: Sat, 30 May 2026 20:35:11 -0400
Subject: [PATCH 4/4] Set read only permissions

---
 .github/workflows/publish-modrinth.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/publish-modrinth.yml b/.github/workflows/publish-modrinth.yml
index c5a4e57..559ecf4 100644
--- a/.github/workflows/publish-modrinth.yml
+++ b/.github/workflows/publish-modrinth.yml
@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   publish: