From 41e61dd93d7e13f599ed55b19edfc9bff902777b Mon Sep 17 00:00:00 2001
From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com>
Date: Wed, 10 Jun 2026 16:09:26 +0200
Subject: [PATCH] Limit Bazel release workflow permissions

---
 .github/workflows/release-bazel.yml | 2 --
 .github/workflows/release.yml       | 2 --
 2 files changed, 4 deletions(-)

diff --git a/.github/workflows/release-bazel.yml b/.github/workflows/release-bazel.yml
index 16a0fcfc2..9b88eb31e 100644
--- a/.github/workflows/release-bazel.yml
+++ b/.github/workflows/release-bazel.yml
@@ -35,8 +35,6 @@ jobs:
       attest: false # too hard to generate the intoto.jsonl file
     permissions:
       contents: write
-      id-token: write
-      attestations: write
     secrets:
       # Necessary to push to the BCR fork, and to open a pull request against a registry
       publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd803d4c4..60cd64aab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,5 @@ jobs:
       tag_name: ${{ github.ref_name }}
     permissions:
       contents: write
-      id-token: write
-      attestations: write
     secrets:
       BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}