Merge branch 'main' into bump/primer-upstream

Author: myabc

.changeset/bump-ruby-versions.md

@@ -15,7 +15,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/release-checklist.yml

@@ -12,6 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write # Required for OIDC
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -38,6 +39,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
+          registry-url: 'https://registry.npmjs.org'
       - name: NPM install
         run: |
           npm ci
@@ -105,6 +107,7 @@ jobs:
     permissions:
       contents: read
       statuses: write
+      id-token: write # Required for OIDC
     uses: ./.github/workflows/release_canary.yml
     with:
       install: npm i
@@ -117,6 +120,7 @@ jobs:
     permissions:
       contents: read
       statuses: write
+      id-token: write # Required for OIDC
     uses: ./.github/workflows/release_candidate.yml
     secrets:
       gh_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -63,12 +63,14 @@ jobs:
           BRANCH="${GITHUB_EVENT_PULL_REQUEST_HEAD_REF}"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git stash push -u -m "pre-auto-commit" || true
           git fetch origin "$BRANCH" --depth=1
           git checkout "$BRANCH"
           git reset --hard "origin/$BRANCH"
           git stash pop || true
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_EVENT_PULL_REQUEST_HEAD_REF: ${{ github.event.pull_request.head.ref }}
       - id: auto-commit
         if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
@@ -77,6 +79,7 @@ jobs:
           commit_message: Generating component snapshots
           file_pattern: .playwright/screenshots/**/*.png .playwright/screenshots/**/*.yml
           push_options: --force-with-lease
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: "Changes detected"
         if: steps.auto-commit.outputs.changes_detected == 'true'
         uses: phulsechinmay/rewritable-pr-comment@a1b041997fa84ec3e524ee9dee5ba0b5f4e73604 # v0.3.0

.github/workflows/test-visual.yml

@@ -58,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       issues: write
-      pull-requests: read
+      pull-requests: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: version-result