ci: add x permission #8

	name: CI

	on:
	push:
	branches: ["main", "dev"]
	pull_request:
	branches: ["main", "dev"]

	jobs:
	tag-latest:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	needs: semantic-release
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	steps:
	# if there were commits during previous steps
	# actions/checkout#1327
	# actions/checkout#461
	- uses: actions/checkout@v4
	with:
	ref: ${{ github.ref }}
	- name: Run latest-tag
	uses: EndBug/[email protected]
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	semantic-release:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	id-token: write
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	token: ${{ secrets.PAT }}
	- name: Set up Python 3.9
	uses: actions/setup-python@v5
	with:
	python-version: '3.9'
	cache: pip
	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install python-semantic-release==8.1.1 poetry==1.8.2
	poetry install
	# to bypass protected branch rules:
	# https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html#example-workflow (warnings section)
	# https://github.com/python-semantic-release/python-semantic-release/issues/311
	- name: semantic-release
	run: \|
	python -m semantic_release version
	python -m semantic_release publish
	env:
	GITHUB_TOKEN: ${{ secrets.PAT }}

Provide feedback