From 58861227e0b1fea7641c3cd0e4283e5c75960b30 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 19 Aug 2026 13:07:07 +0200
Subject: [PATCH] fix(ci): allow RC workflow to revalidate prereleases

---
 .github/workflows/coolify-rc-release.yml   | 2 +-
 tests/Unit/ProductionImageWorkflowTest.php | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/coolify-rc-release.yml b/.github/workflows/coolify-rc-release.yml
index 90005a97d2..d7f4dc830f 100644
--- a/.github/workflows/coolify-rc-release.yml
+++ b/.github/workflows/coolify-rc-release.yml
@@ -165,7 +165,7 @@ jobs:
     needs: [validate, build]
     runs-on: ubuntu-24.04
     permissions:
-      contents: read
+      contents: write
     steps:
       - name: Revalidate draft prerelease
         uses: actions/github-script@v8
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 5fcada3091..659d233122 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -141,6 +141,7 @@ it('requires a reviewed draft prerelease before publishing an exact rc', functio
         ->toContain('!release.prerelease')
         ->toContain('release.body?.trim()')
         ->toContain('revalidate:')
+        ->toMatch('/revalidate:.*?permissions:\s+contents: write/s')
         ->toContain('needs: [validate, build, revalidate]')
         ->toContain('COOLIFY_VERSION=${{ needs.validate.outputs.version }}')
         ->toContain('--tag "${IMAGE}:${VERSION}"')