From e1a3518c4c64ea6c505dad4c9491b486c0221b0d Mon Sep 17 00:00:00 2001
From: deven <devenvcet@gmail.com>
Date: Mon, 12 Oct 2026 01:01:17 +0530
Subject: [PATCH] CI: use GITHUB_TOKEN instead of the expired TOKEN secret

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci-cd.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index c10ab79..d0d6788 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -76,6 +76,9 @@ jobs:
   docker:
     name: Docker Build and Push
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs: [build]
     env:
       REGISTRY: ghcr.io
@@ -101,7 +104,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       
       - name: Extract metadata for Docker
         id: meta
@@ -148,13 +151,13 @@ jobs:
   update-k8s:
     name: Update Kubernetes Deployment
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs: [docker]
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.TOKEN }}
       
       - name: Setup Git config
         run: |