publish-commit-bottles: drop perms, add GPG env

Signed-off-by: William Woodruff <[email protected]>
Homebrew · May 8, 2024 · ebc5093 · ebc5093
1 parent f9e2806
commit ebc5093
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/.github/workflows/publish-commit-bottles.yml b/.github/workflows/publish-commit-bottles.yml
@@ -246,8 +246,6 @@ jobs:
     permissions:
       attestations: write # for `generate build provenance`
       id-token: write # for `generate build provenance`
-      contents: write # for `generate build provenance`
-      packages: write # for `generate build provenance`
       actions: read # for `brew pr-pull`
       pull-requests: write # for `gh pr edit|review`
       repository-projects: write # for `gh pr edit`
@@ -345,6 +343,7 @@ jobs:
         working-directory: ${{steps.set-up-homebrew.outputs.repository-path}}
         env:
           BREWTESTBOT_NAME_EMAIL: "BrewTestBot <[email protected]>"
+          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
           HOMEBREW_GITHUB_PACKAGES_USER: brewtestbot
           HOMEBREW_GITHUB_PACKAGES_TOKEN: ${{secrets.HOMEBREW_CORE_GITHUB_PACKAGES_TOKEN}}
         run: |