From af66e29471b73134a9bc299f027e3aa313bf361e Mon Sep 17 00:00:00 2001
From: The412Banner <the412banner@users.noreply.github.com>
Date: Thu, 24 Sep 2026 12:46:39 -0400
Subject: [PATCH] CI: give the signing job the permissions sign.yml asks for

---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7b8e55d6a..a32dd0572 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -500,6 +500,10 @@ jobs:
   sign:
     needs: build
     if: github.event_name != 'pull_request_target'
+    # What sign.yml asks for; a called workflow never gets more than its caller gives it.
+    permissions:
+      contents: read
+      actions: read
     uses: ./.github/workflows/sign.yml
     with:
       environment: ${{ github.ref == 'refs/heads/main' && 'signing-main' || 'signing-branch' }}