From 8fe2e042d1e6394074533fffc840ac848c4c3d78 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Tue, 7 Apr 2026 16:14:37 +0200
Subject: [PATCH] allow release workflows to create GitHub releases

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/build-agent.yml                | 2 ++
 .github/workflows/build-buildx.yml               | 2 ++
 .github/workflows/build-compose.yml              | 2 ++
 .github/workflows/build-containerd.yml           | 2 ++
 .github/workflows/build-credential-helpers.yml   | 2 ++
 .github/workflows/build-docker-cli.yml           | 2 ++
 .github/workflows/build-docker-engine.yml        | 2 ++
 .github/workflows/build-model.yml                | 2 ++
 .github/workflows/nightly.yml                    | 2 ++
 .github/workflows/release-agent.yml              | 2 ++
 .github/workflows/release-buildx.yml             | 2 ++
 .github/workflows/release-compose.yml            | 2 ++
 .github/workflows/release-containerd.yml         | 2 ++
 .github/workflows/release-credential-helpers.yml | 2 ++
 .github/workflows/release-docker-cli.yml         | 2 ++
 .github/workflows/release-docker-engine.yml      | 2 ++
 .github/workflows/release-model.yml              | 2 ++
 17 files changed, 34 insertions(+)

diff --git a/.github/workflows/build-agent.yml b/.github/workflows/build-agent.yml
index 10c75e10..04d7d664 100644
--- a/.github/workflows/build-agent.yml
+++ b/.github/workflows/build-agent.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: agent
diff --git a/.github/workflows/build-buildx.yml b/.github/workflows/build-buildx.yml
index 277ddf22..d3feaba1 100644
--- a/.github/workflows/build-buildx.yml
+++ b/.github/workflows/build-buildx.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: buildx
diff --git a/.github/workflows/build-compose.yml b/.github/workflows/build-compose.yml
index 5f310487..e82af79c 100644
--- a/.github/workflows/build-compose.yml
+++ b/.github/workflows/build-compose.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: compose
diff --git a/.github/workflows/build-containerd.yml b/.github/workflows/build-containerd.yml
index 1ca47f75..73add8b0 100644
--- a/.github/workflows/build-containerd.yml
+++ b/.github/workflows/build-containerd.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: containerd
diff --git a/.github/workflows/build-credential-helpers.yml b/.github/workflows/build-credential-helpers.yml
index a211d406..9165f83b 100644
--- a/.github/workflows/build-credential-helpers.yml
+++ b/.github/workflows/build-credential-helpers.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: credential-helpers
diff --git a/.github/workflows/build-docker-cli.yml b/.github/workflows/build-docker-cli.yml
index ab05e5b8..332f883f 100644
--- a/.github/workflows/build-docker-cli.yml
+++ b/.github/workflows/build-docker-cli.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: docker-cli
diff --git a/.github/workflows/build-docker-engine.yml b/.github/workflows/build-docker-engine.yml
index 00a61474..2e9a6588 100644
--- a/.github/workflows/build-docker-engine.yml
+++ b/.github/workflows/build-docker-engine.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: docker-engine
diff --git a/.github/workflows/build-model.yml b/.github/workflows/build-model.yml
index 8a230d7d..47c1b214 100644
--- a/.github/workflows/build-model.yml
+++ b/.github/workflows/build-model.yml
@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: model
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 7c8f3fbf..c4cc3f55 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -19,6 +19,8 @@ jobs:
 
   build:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     needs:
       - pkgs
     strategy:
diff --git a/.github/workflows/release-agent.yml b/.github/workflows/release-agent.yml
index 9271dae0..5fc815bb 100644
--- a/.github/workflows/release-agent.yml
+++ b/.github/workflows/release-agent.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: agent
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-buildx.yml b/.github/workflows/release-buildx.yml
index 6be7ed48..9b859ca8 100644
--- a/.github/workflows/release-buildx.yml
+++ b/.github/workflows/release-buildx.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: buildx
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-compose.yml b/.github/workflows/release-compose.yml
index 88a02de1..8514cd46 100644
--- a/.github/workflows/release-compose.yml
+++ b/.github/workflows/release-compose.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: compose
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-containerd.yml b/.github/workflows/release-containerd.yml
index 77208444..9a85eb21 100644
--- a/.github/workflows/release-containerd.yml
+++ b/.github/workflows/release-containerd.yml
@@ -49,6 +49,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: containerd
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-credential-helpers.yml b/.github/workflows/release-credential-helpers.yml
index 164ff488..a273cccb 100644
--- a/.github/workflows/release-credential-helpers.yml
+++ b/.github/workflows/release-credential-helpers.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: credential-helpers
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-docker-cli.yml b/.github/workflows/release-docker-cli.yml
index 09c2b2d4..b2506a01 100644
--- a/.github/workflows/release-docker-cli.yml
+++ b/.github/workflows/release-docker-cli.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: docker-cli
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-docker-engine.yml b/.github/workflows/release-docker-engine.yml
index 86302e23..0ca1b5f4 100644
--- a/.github/workflows/release-docker-engine.yml
+++ b/.github/workflows/release-docker-engine.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: docker-engine
       release: ${{ inputs.release }}
diff --git a/.github/workflows/release-model.yml b/.github/workflows/release-model.yml
index e5b7a537..fd47fc79 100644
--- a/.github/workflows/release-model.yml
+++ b/.github/workflows/release-model.yml
@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: model
       release: ${{ inputs.release }}