From 2fe84ca11a9b5bac25a91dc1c147589b1dbe263b Mon Sep 17 00:00:00 2001
From: "James M. Greene" <JamesMGreene@github.com>
Date: Thu, 16 Feb 2023 13:10:55 -0600
Subject: [PATCH 1/3] Add new dedicated workflow for updating draft releases

---
 .github/workflows/draft-release.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .github/workflows/draft-release.yml

diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
new file mode 100644
index 0000000..d6d081b
--- /dev/null
+++ b/.github/workflows/draft-release.yml
@@ -0,0 +1,17 @@
+name: Draft release
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  draft-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: release-drafter/release-drafter@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From f215e05bdccbcb2e1a62c2aadaee7c84b0c63e80 Mon Sep 17 00:00:00 2001
From: "James M. Greene" <JamesMGreene@github.com>
Date: Thu, 16 Feb 2023 13:11:18 -0600
Subject: [PATCH 2/3] Remove dangling release drafter step from test workflow

---
 .github/workflows/test.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index df70c38..6937d5e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,9 +23,3 @@ jobs:
 
       - name: Run tests
         run: npm run test
-
-      # Drafts your next Release notes as Pull Requests are merged into "main"
-      - uses: release-drafter/release-drafter@v5
-        if: github.ref_name == 'main'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From d6aec1031dd375eab393ab118774ef5b3b779037 Mon Sep 17 00:00:00 2001
From: "James M. Greene" <JamesMGreene@github.com>
Date: Wed, 22 Feb 2023 11:51:01 -0600
Subject: [PATCH 3/3] Restrict test workflow permissions to reading contents
 only

---
 .github/workflows/test.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6937d5e..8d844c5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,10 +1,14 @@
 name: Run Tests
+
 on:
   push:
     branches:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest