From aca9b189b9f8a1a1656e58c7973a4e4d08bc34cb Mon Sep 17 00:00:00 2001
From: Matsu <matias.huhta@n8n.io>
Date: Fri, 11 Sep 2026 10:09:56 +0000
Subject: [PATCH] ci: Grant contents read to the bundle PR retarget job
 (no-changelog) (#38425)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/sec-sync-bundle-branches.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/sec-sync-bundle-branches.yml b/.github/workflows/sec-sync-bundle-branches.yml
index 720b80b6f33..04d14f5d46e 100644
--- a/.github/workflows/sec-sync-bundle-branches.yml
+++ b/.github/workflows/sec-sync-bundle-branches.yml
@@ -100,6 +100,7 @@ jobs:
     needs: [sync]
     if: ${{ !cancelled() && needs.sync.result != 'skipped' }}
     permissions:
+      contents: read # read the bundle branch ref
       pull-requests: write
     uses: ./.github/workflows/sec-sync-retarget-prs.yml