From e89cfd98562865552503d793e4171a4872e81db3 Mon Sep 17 00:00:00 2001
From: Keshav Priyadarshi <git@keshav.space>
Date: Thu, 17 Sep 2026 13:41:41 +0530
Subject: [PATCH] ci: add proper permissions for release workflow

Signed-off-by: Keshav Priyadarshi <git@keshav.space>
---
 .github/workflows/publish-docker-image.yml |  4 +--
 .github/workflows/pypi-release.yml         | 34 ++++++++++++----------
 2 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/publish-docker-image.yml b/.github/workflows/publish-docker-image.yml
index 3a70035..fc65e31 100644
--- a/.github/workflows/publish-docker-image.yml
+++ b/.github/workflows/publish-docker-image.yml
@@ -43,7 +43,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=sha,event=workflow_dispatch,enable=${{ !startsWith(github.ref, 'refs/tags/') }}
             type=semver,pattern={{version}}
           labels: |
             org.opencontainers.image.title=HealthyCode
@@ -67,10 +66,11 @@ jobs:
             ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
+          provenance: false
 
       - name: Generate artifact attestation for Docker image
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  #  v4.1.0
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
\ No newline at end of file
+          push-to-registry: true
diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml
index 0a9bb54..bd0f6e8 100644
--- a/.github/workflows/pypi-release.yml
+++ b/.github/workflows/pypi-release.yml
@@ -49,11 +49,14 @@ jobs:
           path: dist/*
 
 
-  create-gh-release:
-    name: Create GH release
+  create-pypi-release:
+    name: Create PyPI release
     needs:
-      - build-pypi-distribs
+      - create-gh-release
     runs-on: ubuntu-24.04
+    environment: pypi-publish
+    permissions:
+      id-token: write
 
     steps:
       - name: Download built archives
@@ -62,21 +65,18 @@ jobs:
           name: pypi_archives
           path: dist
 
-      - name: Create GH release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
-        with:
-          draft: true
-          files: dist/*
+      - name: Publish to PyPI
+        if: startsWith(github.ref, 'refs/tags')
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
 
 
-  create-pypi-release:
-    name: Create PyPI release
+  create-gh-release:
+    name: Create GH release
     needs:
-      - create-gh-release
+      - build-pypi-distribs
     runs-on: ubuntu-24.04
-    environment: pypi-publish
     permissions:
-      id-token: write
+      contents: write
 
     steps:
       - name: Download built archives
@@ -85,6 +85,8 @@ jobs:
           name: pypi_archives
           path: dist
 
-      - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
\ No newline at end of file
+      - name: Create GH release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
+        with:
+          draft: true
+          files: dist/*