From baa6edc051894c71bf722a6746f73d8e7715dfa4 Mon Sep 17 00:00:00 2001
From: Lifei Zhou <lifei@squareup.com>
Date: Fri, 17 Jul 2026 11:10:55 +1000
Subject: [PATCH] fix: canary build with new release flow (#10521)

---
 .github/workflows/canary.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 3ad2e8af1..8018055d1 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -106,6 +106,9 @@ jobs:
   bundle-windows:
     needs: [prepare-version]
     uses: ./.github/workflows/bundle-windows.yml
+    permissions:
+      contents: read
+      id-token: write
     with:
       version: ${{ needs.prepare-version.outputs.version }}
       package_cli: true
@@ -115,6 +118,9 @@ jobs:
   bundle-windows-cuda:
     needs: [prepare-version]
     uses: ./.github/workflows/bundle-windows.yml
+    permissions:
+      contents: read
+      id-token: write
     with:
       version: ${{ needs.prepare-version.outputs.version }}
       package_cli: true