The release workflow was inheriting default GITHUB_TOKEN permissions for the build job, which triggered the code scanning alert for missing explicit workflow permissions. This change narrows the workflow default while preserving the release job’s required write access.

• Workflow permissions

  • Added an explicit top-level permissions block to .github/workflows/release.yml
  • Set the default token scope to contents: read for jobs that do not need elevated access

• Release behavior

  • Kept the release job’s existing permissions: contents: write unchanged
  • Leaves tag-based release creation behavior intact while reducing privilege for the rest of the workflow

permissions:
  contents: read

jobs:
  build:
    ...

  release:
    permissions:
      contents: write