From 5d1d0d569f80d18aa4539add86abf1aaae25dabc Mon Sep 17 00:00:00 2001
From: mkorwel <matt.korwel@gmail.com>
Date: Thu, 23 Oct 2025 22:40:27 -0700
Subject: [PATCH] fix(e2e): grant package read permissions to e2e job

This ensures the reusable e2e workflow has the necessary permissions to pull the sandbox image from GHCR.
---
 .github/workflows/orchestrator.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/orchestrator.yml b/.github/workflows/orchestrator.yml
index 3c2b073852..6b1460e9ad 100644
--- a/.github/workflows/orchestrator.yml
+++ b/.github/workflows/orchestrator.yml
@@ -69,6 +69,9 @@ jobs:
     name: 'E2E Checks'
     needs: ['build-and-publish', 'get-vars']
     uses: './.github/workflows/e2e.yml'
+    permissions:
+      contents: 'read'
+      packages: 'read'
     with:
       version: '${{ needs.build-and-publish.outputs.version }}'
       cli-package-name: '${{ needs.get-vars.outputs.cli-package-name }}'