From 923d329612a142d9eb8bd9f29f820b535170154a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Aug 2026 04:12:13 +0000
Subject: [PATCH 1/2] Initial plan


From 4b7746687bfc26ac28f0c978cf25d53018367c74 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Aug 2026 04:14:09 +0000
Subject: [PATCH 2/2] fix: restrict create-release tag job permissions

Co-authored-by: JarryShaw <15666417+JarryShaw@users.noreply.github.com>
---
 .github/workflows/create-release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index ed78b67eb..c403cf65b 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -83,6 +83,7 @@ jobs:
   tag:
     name: Conda Tag
     runs-on: ubuntu-latest
+    permissions: {}
     needs: [ version_check ]
     if: ${{ startsWith(github.ref_name, 'v') || needs.version_check.outputs.PCAPKIT_TAG_EXISTS == 'false' }}
     steps: