From 52bad7644d0c194d753b88f8c0aeeea413a7f637 Mon Sep 17 00:00:00 2001
From: Pradeep Elankumaran <pradeepe@gmail.com>
Date: Tue, 22 Sep 2026 13:46:05 -0700
Subject: [PATCH] ci: authenticate Camoufox release fetches

---
 .github/workflows/ci.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index becd521..2010842 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     runs-on: ubuntu-latest
@@ -64,6 +67,9 @@ jobs:
 
       - name: Install Camoufox
         run: npm run fetch-bin
+        env:
+          # camoufox-js uses this for authenticated GitHub release lookups.
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Verify Windows process cleanup
         shell: pwsh
@@ -143,6 +149,9 @@ jobs:
 
       - name: Install Camoufox
         run: npm run fetch-bin
+        env:
+          # camoufox-js uses this for authenticated GitHub release lookups.
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run browser E2E tests
         shell: pwsh