From 242566f9b12fbe532f6446b345413575654234f5 Mon Sep 17 00:00:00 2001
From: Bruno Domingues <bruno.domingues@aignosi.com.br>
Date: Wed, 21 Oct 2026 11:44:53 -0300
Subject: [PATCH 1/2] fix(ci): grant contents:write permission to version-bump
 workflow

Caller workflow had no permissions block, so GitHub's permission-
intersection rule capped the nested reusable-version-bump.yml call
to read-only, breaking dispatch ("requesting 'contents: write', but
is only allowed 'contents: read'").

[skip ci]
---
 .github/workflows/version-bump.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index 29abd1c..11dec02 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -1,5 +1,8 @@
 name: Version Bump
 
+permissions:
+  contents: write
+
 on:
   pull_request:
     types: [closed]

From dc9fd871bb798107878735e0c5afa9c4fb3191b3 Mon Sep 17 00:00:00 2001
From: Bruno Domingues <bruno.domingues@aignosi.com.br>
Date: Wed, 21 Oct 2026 14:10:25 -0300
Subject: [PATCH 2/2] fix(ci): restaura pull-requests:read no deploy.yml,
 exigido pelo release-tarball
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reusable-deploy-dataops.yml encadeia release-tarball -> dataops-module-release.yml,
que pede pull-requests:read; GitHub valida a interseção de permissions em todo o
workflow_call encadeado, independente do if: que gate o job. Removido por engano
em 586a5b9, achando que só existia por causa do trigger pull_request antigo.

[skip ci]
---
 .github/workflows/deploy.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bf6966c..80cf774 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -14,6 +14,7 @@ on:
 permissions:
   contents: write
   id-token: write
+  pull-requests: read
 
 jobs:
   deploy: