From 9b4598f708adbd6a91c9ae6c19a3b960e9ba4039 Mon Sep 17 00:00:00 2001
From: Finn Evers <finn@zed.dev>
Date: Thu, 9 Jul 2026 13:19:07 +0200
Subject: [PATCH] ci: Fix insufficient permissions for asset validation step
 (#60625)

Release Notes:

- N/A
---
 .github/workflows/release.yml                |  2 ++
 tooling/xtask/src/tasks/workflows/release.rs | 11 ++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ec65ab2c87..5a3808e063 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -760,6 +760,8 @@ jobs:
     needs:
     - upload_release_assets
     runs-on: namespace-profile-2x4-ubuntu-2404
+    permissions:
+      contents: write
     steps:
     - name: release::validate_release_assets
       run: |
diff --git a/tooling/xtask/src/tasks/workflows/release.rs b/tooling/xtask/src/tasks/workflows/release.rs
index fc3060e375..ba6bafb933 100644
--- a/tooling/xtask/src/tasks/workflows/release.rs
+++ b/tooling/xtask/src/tasks/workflows/release.rs
@@ -356,9 +356,14 @@ fn validate_release_assets(deps: &[&NamedJob]) -> NamedJob {
     };
 
     named::job(
-        dependant_job(deps).runs_on(runners::LINUX_SMALL).add_step(
-            named::bash(&validation_script).add_env(("GITHUB_TOKEN", vars::GITHUB_TOKEN)),
-        ),
+        dependant_job(deps)
+            .runs_on(runners::LINUX_SMALL)
+            // The release is still a draft at this point, and draft releases are
+            // only visible to tokens with write access to repository contents.
+            .permissions(Permissions::default().contents(Level::Write))
+            .add_step(
+                named::bash(&validation_script).add_env(("GITHUB_TOKEN", vars::GITHUB_TOKEN)),
+            ),
     )
 }