From e0596e78a881aef1194df0b9703a4af0bd196cfc Mon Sep 17 00:00:00 2001
From: Nick Sweeting <git@sweeting.me>
Date: Wed, 29 Jul 2026 06:44:48 -0700
Subject: [PATCH] Scope release privileges and stable packaging

---
 .github/workflows/release.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54838089..8ab1ac97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,11 +6,7 @@ on:
     types: [completed]
     branches: [dev, main]
 
-permissions:
-  actions: read
-  contents: write
-  id-token: write
-  packages: write
+permissions: {}
 
 concurrency:
   group: release-${{ github.repository }}-${{ github.event.workflow_run.head_branch }}
@@ -29,6 +25,10 @@ jobs:
     if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
     runs-on: ubuntu-24.04
     environment: pypi
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
     outputs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
@@ -146,6 +146,10 @@ jobs:
     if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
     needs: python-release
     runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      packages: write
     steps:
       - name: Checkout the tested commit
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -290,9 +294,13 @@ jobs:
 
   downstream-packages:
     name: Verify downstream packages
+    if: github.event.workflow_run.head_branch == 'main' && !contains(needs.python-release.outputs.tag, 'rc')
     needs:
       - python-release
       - docker-release
+    permissions:
+      actions: read
+      contents: read
     uses: ./.github/workflows/update-homebrew-tap.yml
     with:
       release_tag: ${{ needs.python-release.outputs.tag }}