Crossfi node issue

[kazymun]

permissions: write-all is too broad. If an attacker gains access to your workflow (e.g via a compromised dependency or secret leak), they could modify code, delete releases, or push malicious changes.

[kazymun]