From c38a8cd32bdefb7297b0d460dbdf5b57aa0df1bc Mon Sep 17 00:00:00 2001
From: erwan-joly <erwan.joly+pro@gmail.com>
Date: Sun, 30 Aug 2026 21:25:46 +1200
Subject: [PATCH] ci: read-only build job, write token confined to the tag
 release job

Build and test ran pull-request code in a job holding a contents: write
token that checkout also persisted into .git/config. Validation now runs
in a read-only job with persist-credentials: false; packing, the NuGet
push and the release upload move to a tag-gated job that alone gets
contents: write. action-gh-release bumped to v3 for the current runner
runtime.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/dotnet.yml | 39 +++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 15f960c..6b71160 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -7,13 +7,38 @@ on:
       - '*.*.*'
   pull_request:
     branches: [ master ]
+
+permissions:
+  contents: read
+
 jobs:
   build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Run Unit Tests
+      run: |
+        dotnet restore
+        dotnet build
+        dotnet test test/NosCore.ParserInputGenerator.Tests -v m
+
+  release:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
@@ -26,13 +51,7 @@ jobs:
             echo "match=true" >> $GITHUB_OUTPUT
         fi
 
-    - name: Run Unit Tests
-      run: |
-        dotnet restore
-        dotnet build
-        dotnet test test/NosCore.ParserInputGenerator.Tests -v m
-
-    - name: Build Artifact
+    - name: Pack and push to NuGet
       if: steps.check-tag.outputs.match == 'true'
       id: build_artifact
       run: |
@@ -45,6 +64,8 @@ jobs:
 
     - name: Upload Release Asset
       if: steps.check-tag.outputs.match == 'true'
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         files: ${{ steps.build_artifact.outputs.ARTIFACT_PATH }}
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}