steipete · Yuxin-Qiao · Jul 22, 2026 · Jul 23, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/.github/workflows/release-cli.yml b/.github/workflows/release-cli.yml
@@ -11,10 +11,12 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build-cli:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -396,31 +398,50 @@ jobs:
           echo "out_dir=$OUT_DIR" >> "$GITHUB_OUTPUT"
           echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
 
-      - name: Upload release assets
-        if: github.event_name == 'release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          TAG="${RELEASE_TAG}"
-          OUT_DIR="${{ steps.pkg.outputs.out_dir }}"
-          ASSET="${{ steps.pkg.outputs.asset }}"
-          gh release upload "$TAG" "$OUT_DIR/$ASSET" "$OUT_DIR/$ASSET.sha256" --clobber
-
-      - name: Upload workflow artifact (manual runs)
-        if: github.event_name == 'workflow_dispatch'
+      - name: Upload packaged artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: codexbar-cli-${{ matrix.name }}
           path: |
             ${{ steps.pkg.outputs.out_dir }}/${{ steps.pkg.outputs.asset }}
             ${{ steps.pkg.outputs.out_dir }}/${{ steps.pkg.outputs.asset }}.sha256
 
+  publish-release-assets:
+    runs-on: ubuntu-24.04
+    needs: build-cli
+    if: github.event_name == 'release'
+    permissions:
+      actions: read
+      contents: write
+    steps:
+      - name: Download packaged artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: codexbar-cli-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Upload release assets
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t assets < <(find release-assets -maxdepth 1 -type f \
+            \( -name 'CodexBarCLI-*.tar.gz' -o -name 'CodexBarCLI-*.tar.gz.sha256' \) -print | sort)
+          if [[ "${#assets[@]}" -ne 12 ]]; then
+            printf 'Expected 12 CLI release files, found %s.\n' "${#assets[@]}" >&2
+            printf '%s\n' "${assets[@]:-<none>}" >&2
+            exit 1
+          fi
+          gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber
+
   update-homebrew-tap:
     runs-on: ubuntu-24.04
     needs: build-cli
     if: github.event_name == 'release'
+    permissions: {}
     steps:
       - name: Resolve release tag
         id: release

diff --git a/Scripts/lint.sh b/Scripts/lint.sh
@@ -79,6 +79,10 @@ check_documentation_links() {
   node "${ROOT_DIR}/Scripts/check-documentation-links.mjs"
 }
 
+check_release_cli_permissions() {
+  "${ROOT_DIR}/Scripts/test_release_cli_permissions.sh"
+}
+
 check_llms_index() {
   node "${ROOT_DIR}/Scripts/generate-llms.mjs" --check
 }
@@ -93,10 +97,12 @@ run_portable_checks() {
   check_sparkle_signing_paths
   check_swift_test_sharding
   check_ci_path_gate
+  check_release_cli_permissions
   check_repository_size
   check_shell_scripts
   check_documentation_links
   check_llms_index
+  check_release_cli_permissions
   check_site_locales
 }
 

diff --git a/Scripts/test_release_cli_permissions.sh b/Scripts/test_release_cli_permissions.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKFLOW="${ROOT_DIR}/.github/workflows/release-cli.yml"
+
+python3 - "$WORKFLOW" <<'PY'
+import pathlib
+import re
+import sys
+
+workflow = pathlib.Path(sys.argv[1]).read_text()
+
+if not re.search(r"(?ms)^permissions:\n  contents: read\n", workflow):
+    raise SystemExit("release workflow must default to read-only repository contents")
+
+
+def job(name: str) -> str:
+    match = re.search(rf"(?ms)^  {re.escape(name)}:\n(?P<body>.*?)(?=^  [A-Za-z0-9_-]+:|\Z)", workflow)
+    if match is None:
+        raise SystemExit(f"missing {name} job")
+    return match.group("body")
+
+
+build = job("build-cli")
+if not re.search(r"(?ms)^    permissions:\n      contents: read\n", build):
+    raise SystemExit("build-cli must receive only read access to repository contents")
+if "contents: write" in build:
+    raise SystemExit("build-cli must not receive repository write access")
+if "Upload packaged artifact" not in build or "if: github.event_name" in build.split("Upload packaged artifact", 1)[1].split("\n  ", 1)[0]:
+    raise SystemExit("build-cli must upload its packaged artifact for every run")
+
+publisher = job("publish-release-assets")
+for required in (
+    "needs: build-cli",
+    "if: github.event_name == 'release'",
+    "actions: read",
+    "contents: write",
+    "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093",
+    "pattern: codexbar-cli-*",
+    "merge-multiple: true",
+    'gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber',
+):
+    if required not in publisher:
+        raise SystemExit(f"release publisher is missing: {required}")
+
+tap = job("update-homebrew-tap")
+if "permissions: {}" not in tap:
+    raise SystemExit("tap updater must not receive the repository token")
+
+print("Release CLI permissions workflow tests passed.")
+PY