From f737a2c04cad460c8cdb036cde5bbc590bffca16 Mon Sep 17 00:00:00 2001
From: Steve Boyd <emteknetnz@gmail.com>
Date: Thu, 22 Aug 2024 16:10:01 +1200
Subject: [PATCH] FIX Add actions write permission to token when using
 gha-tag-release

---
 scripts/cms-any/tag-patch-release.php | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/cms-any/tag-patch-release.php b/scripts/cms-any/tag-patch-release.php
index c6d6c37..4cc5af0 100644
--- a/scripts/cms-any/tag-patch-release.php
+++ b/scripts/cms-any/tag-patch-release.php
@@ -2,6 +2,19 @@
 
 $account = module_account();
 
+$permissions = <<<EOT
+permissions:
+      contents: write
+EOT;
+if (is_gha_repository()) {
+  // gha repositories will dispatch auto-tag.yml from within the gha-tag-release action
+  $permissions = <<<EOT
+  permissions:
+        actions: write
+        contents: write
+  EOT;
+}
+
 $content = <<<EOT
 name: Tag patch release
 
@@ -22,8 +35,7 @@
     # Only run cron on the $account account
     if: (github.event_name == 'schedule' && github.repository_owner == '$account') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
+    $permissions
     steps:
       - name: Tag release
         uses: silverstripe/gha-tag-release@v2