From 7b724f584818835a2abb4cc73f1bb5ffeb35d0e1 Mon Sep 17 00:00:00 2001
From: atishj99 <atish.jadhav@checkmarx.com>
Date: Thu, 3 Sep 2026 14:39:11 +0530
Subject: [PATCH] Grant OIDC permissions to cleanup job

Adds the required workflow permissions for the dev-release cleanup job. This enables OIDC token generation and allows the job to delete git tags/releases and clean up package artifacts during release processing.
---
 .github/workflows/release.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fb50eb21..be91e4fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,10 @@ permissions: {}
 
 jobs:
   deleteDevReleases:
+    permissions:
+      id-token: write  # for OIDC token generation
+      contents: write  # for git tag/release deletion
+      packages: write  # for artifact registry cleanup
     uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
     with:
       tag: ${{ inputs.rbranch }}