[9larsons]

Why

The shared-theme-assets and theme-translations workflows granted contents: write and id-token: write at workflow scope. Every job inherited those permissions, including tests, dependency installation, and the shared-assets pull-request dry run.

PLA-329 limits publish credentials to the jobs that actually publish.

What changed

• defaults both npm workflows to contents: read
• grants contents: write and id-token: write only to:
  • shared-theme-assets / publish
  • theme-translations / publish
• leaves tests and the shared-assets dry run read-only
• does not change pnpm policy or other PLA-321 configuration

The publish jobs retain the permissions needed for npm provenance and their existing tag/version commits. No workflow uses packages: write.

Permission audit

Audited all 34 root and embedded theme workflows. The only effective write grants are the two publish jobs above. Every dependency-installing test/build job has no id-token: write, contents: write, or packages: write.

Validation

• permission assertions across all 34 workflows
• actionlint on all embedded theme workflows
• root actionlint -ignore SC2015 (the two excluded SC2015 diagnostics already exist on main in unchanged translation publish shell logic)
• corepack pnpm install --frozen-lockfile
• corepack pnpm test:ci --theme taste
• corepack pnpm build
• npm test --prefix packages/theme-translations
• npm publish --provenance --dry-run for both npm packages
• git diff --check

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts