From d59cd14391a8c6cf9a1df3dba25b15adb34daa96 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Tue, 16 Jun 2026 02:38:06 -0300
Subject: [PATCH] fix(ci): electron-release publish-npm contents:write (#3966)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v3.8.25→v3.8.26 #3874 fix bumped npm-publish.yml's publish job to contents:write
(gh release upload for the SBOM). electron-release.yml calls that workflow as a reusable
job (publish-npm) but only granted contents:read — a reusable job cannot request more
than the caller grants, so GitHub rejected the v3.8.26 electron run at startup
(startup_failure). Aligns the caller permission to contents:write.
---
 .github/workflows/electron-release.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/electron-release.yml b/.github/workflows/electron-release.yml
index 372e093525..156e4ae80e 100644
--- a/.github/workflows/electron-release.yml
+++ b/.github/workflows/electron-release.yml
@@ -268,7 +268,11 @@ jobs:
     name: Publish to npm
     needs: [validate, release]
     permissions:
-      contents: read
+      # Must be `write`, not `read`: this job calls the reusable npm-publish.yml whose
+      # `publish` job needs `contents: write` (gh release upload — attach the SBOM, #3874).
+      # A reusable workflow's job cannot request more permission than the caller grants,
+      # so a `read` here makes GitHub reject the run at startup (startup_failure).
+      contents: write
       id-token: write # npm provenance (forwarded to the reusable workflow)
       packages: write # publish to npm.pkg.github.com
     uses: ./.github/workflows/npm-publish.yml