Scoped theme publish permissions (PLA-329)

[9larsons]

Why

The shared-theme-assets and theme-translations workflows granted contents: write and id-token: write at workflow scope. Every job inherited those permissions, including tests, dependency installation, and the shared-assets pull-request dry run.

PLA-329 limits publish credentials to the jobs that actually publish.

What changed

• defaults both npm workflows to contents: read
• grants contents: write and id-token: write only to:
  • shared-theme-assets / publish
  • theme-translations / publish
• leaves tests and the shared-assets dry run read-only
• does not change pnpm policy or other PLA-321 configuration

The publish jobs retain the permissions needed for npm provenance and their existing tag/version commits. No workflow uses packages: write.

Permission audit

Audited all 34 root and embedded theme workflows. The only effective write grants are the two publish jobs above. Every dependency-installing test/build job has no id-token: write, contents: write, or packages: write.

Validation

• permission assertions across all 34 workflows
• actionlint on all embedded theme workflows
• root actionlint -ignore SC2015 (the two excluded SC2015 diagnostics already exist on main in unchanged translation publish shell logic)
• corepack pnpm install --frozen-lockfile
• corepack pnpm test:ci --theme taste
• corepack pnpm build
• npm test --prefix packages/theme-translations
• npm publish --provenance --dry-run for both npm packages
• git diff --check

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1350b23c-8575-474c-bb29-ef38551c367a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}