From 103bf239b3c2fb24bdd6db2164854ab7a058c8a8 Mon Sep 17 00:00:00 2001
From: Jack Amadeo <jackamadeo@block.xyz>
Date: Thu, 27 Aug 2026 05:52:18 -0400
Subject: [PATCH] ci: scope release token permissions to jobs (#1220)

---
 .github/workflows/release-plz.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 4c4356e..41570a6 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -1,8 +1,6 @@
 name: Release-plz
 
-permissions:
-  pull-requests: write
-  contents: write
+permissions: {}
 
 on:
   push:
@@ -18,6 +16,7 @@ jobs:
     if: ${{ github.repository_owner == 'modelcontextprotocol' }}
     permissions:
       contents: write
+      pull-requests: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1