From bd7273f5bd242d26afa3f5a457f106640ac935c5 Mon Sep 17 00:00:00 2001
From: konard <drakonard@gmail.com>
Date: Wed, 22 Jul 2026 21:12:20 +0000
Subject: [PATCH 1/3] Initial commit with task details

Adding .gitkeep for PR creation (default mode).
This file will be removed when the task is complete.

Issue: https://github.com/link-foundation/python-ai-driven-development-pipeline-template/issues/33
---
 .gitkeep | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .gitkeep

diff --git a/.gitkeep b/.gitkeep
new file mode 100644
index 0000000..6e57cd9
--- /dev/null
+++ b/.gitkeep
@@ -0,0 +1 @@
+# .gitkeep file auto-generated at 2026-07-22T21:12:19.999Z for PR creation at branch issue-33-42c5c4da9408 for issue https://github.com/link-foundation/python-ai-driven-development-pipeline-template/issues/33
\ No newline at end of file

From f5ff260e7eb2819ee364af4568791cba16b3e938 Mon Sep 17 00:00:00 2001
From: konard <drakonard@gmail.com>
Date: Wed, 22 Jul 2026 21:14:55 +0000
Subject: [PATCH 2/3] fix(ci): restrict release workflow permissions

---
 .github/workflows/release.yml                        |  3 +++
 changelog.d/20260722_issue_33_release_permissions.md |  4 ++++
 tests/test_workflows.py                              | 11 +++++++++++
 3 files changed, 18 insertions(+)
 create mode 100644 changelog.d/20260722_issue_33_release_permissions.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b1abd52..9485fa4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
diff --git a/changelog.d/20260722_issue_33_release_permissions.md b/changelog.d/20260722_issue_33_release_permissions.md
new file mode 100644
index 0000000..fdc6355
--- /dev/null
+++ b/changelog.d/20260722_issue_33_release_permissions.md
@@ -0,0 +1,4 @@
+### Security
+
+- Default the release workflow token to read-only repository access, with write
+  access limited to the publishing jobs that require it.
diff --git a/tests/test_workflows.py b/tests/test_workflows.py
index 8917fd3..122edf2 100644
--- a/tests/test_workflows.py
+++ b/tests/test_workflows.py
@@ -71,6 +71,17 @@ def test_release_workflow_keeps_main_releases_running() -> None:
     assert "cancel-in-progress: true" not in workflow
 
 
+def test_release_workflow_uses_least_privilege_permissions() -> None:
+    """Only publishing jobs should receive write-capable tokens."""
+    workflow = read_workflow("release.yml")
+
+    assert "\npermissions:\n  contents: read\n" in workflow
+
+    for job_name in ("auto-release", "manual-release"):
+        block = workflow_job_block(workflow, job_name)
+        assert "permissions:\n      contents: write\n      id-token: write" in block
+
+
 def test_release_workflow_jobs_have_explicit_timeouts() -> None:
     """Release workflow jobs should fail fast instead of using the six-hour default."""
     workflow = read_workflow("release.yml")

From 81b90b55aba4b67cad6a58f3cfef8a531f36ca2f Mon Sep 17 00:00:00 2001
From: konard <drakonard@gmail.com>
Date: Wed, 22 Jul 2026 21:16:18 +0000
Subject: [PATCH 3/3] chore: remove pull request scaffold marker

---
 .gitkeep | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 .gitkeep

diff --git a/.gitkeep b/.gitkeep
deleted file mode 100644
index 6e57cd9..0000000
--- a/.gitkeep
+++ /dev/null
@@ -1 +0,0 @@
-# .gitkeep file auto-generated at 2026-07-22T21:12:19.999Z for PR creation at branch issue-33-42c5c4da9408 for issue https://github.com/link-foundation/python-ai-driven-development-pipeline-template/issues/33
\ No newline at end of file