From 9ab9b550d13248c9b8f06de8f66b26a767757090 Mon Sep 17 00:00:00 2001
From: Tomas Dvorak <contact.dvorak@gmail.com>
Date: Mon, 28 Sep 2026 16:41:17 +0200
Subject: [PATCH] fix(release): contents:write for SBOM asset upload

The sbom job's `permissions: packages: read` replaces the default token
set, so `gh release upload` got 403 Resource not accessible. Grant
contents:write alongside packages:read.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45ecd69..588f78b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -327,6 +327,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: read
+      # contents: write — the job uploads SBOM assets onto the release.
+      contents: write
     env:
       VERSION: ${{ needs.verify.outputs.version }}
     steps: