From 4083e1c7d9a47589ef558ae4bccdfb3fe900d433 Mon Sep 17 00:00:00 2001 From: Nick Nicholas Date: Tue, 11 Aug 2026 21:22:04 +1000 Subject: [PATCH] cimas: sync 2026-08-10 wave (3-week drift catch-up + standoc-models P3) Fortnightly cimas sync wave 2026-08-10. 97 of 137 mapped repos have accumulated drift over 3 weeks since last wave (2026-07-22). Key changes: standoc-models P3 monorepo entry (metanorma-core#16 / ci#390), mn-samples-plateau docker.yml unmap (ci#388), ci#375/#376 supersedes (ci#383/#384/#385), gh-actions/model/Makefile verify-images defensive check (ci#302/#303). request-checks: true --- .github/workflows/release.yml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab1df82..878f433 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,21 +14,17 @@ on: repository_dispatch: types: [ do-release ] +# Least-privilege ceiling for the called rubygems-release.yml: its release job +# needs contents:write (git tag push) and id-token:write (OIDC Trusted Publishing). +permissions: + contents: write + id-token: write + jobs: release: uses: metanorma/ci/.github/workflows/rubygems-release.yml@main with: next_version: ${{ github.event.inputs.next_version }} - # Explicit release_command needed since metanorma/ci#314 deprecated - # `bundler_cache` (hardcoded to false) — the reusable's release job no - # longer runs `bundle install` implicitly via ruby/setup-ruby, so the - # default `bundle exec rake release` fires against uninstalled gems. - # Surfaced by kwkwan on metanorma-plugin-lutaml#285. Deeper fix - # (bundle install inside rubygems-release.yml's release job) tracked - # separately. - release_command: | - bundle install - bundle exec rake release secrets: rubygems-api-key: ${{ secrets.METANORMA_CI_RUBYGEMS_API_KEY }} pat_token: ${{ secrets.METANORMA_CI_PAT_TOKEN }}