From 4066a2ca3122f4c81ec17eb2b7b8b3fa0c9c52fc Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Mon, 15 Jun 2026 04:17:19 -0300
Subject: [PATCH] fix(ci): grant contents:write to npm publish job for SBOM
 attach (#3874)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Post-release v3.8.25 CI hotfix — SBOM attach needs contents:write.
---
 .github/workflows/npm-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index aae158566b..a51b2d6d7d 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -50,7 +50,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write # gh release upload (attach SBOM to the GitHub Release)
       id-token: write # npm provenance
       packages: write # publish to npm.pkg.github.com
     steps: