ci: harden release workflow permissions (contents-only top-level)

Author: intel352

.github/workflows/release.yml

@@ -1,12 +1,11 @@
 name: Release
 run-name: Release ${{ github.event.inputs.version || github.event.inputs.releaseType }}
 
-# Explicit minimal permissions per security guidance
+# Explicit minimal permissions per security guidance (code scanning recommendation).
+# Provide ONLY the permission strictly required at the workflow scope. Jobs that need
+# additional scopes (e.g., creating PRs) declare their own permissions blocks.
 permissions:
   contents: write        # needed to create tags/releases and read repo contents
-  pull-requests: read    # read PR metadata if version derived from PR context
-  actions: read          # allow reading action metadata (optional informational)
-  checks: read           # allow reading check runs (used indirectly by gh in some contexts)
 
 on:
   workflow_dispatch:
@@ -52,11 +51,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     # Harden job: restrict token further if steps don't need broader scopes
+    # Job requires only contents:write for tagging & release artifact upload.
     permissions:
-      contents: write   # create tag & release
-      pull-requests: read
-      actions: read
-      checks: read
+      contents: write
     outputs:
       released_version: ${{ steps.version.outputs.next_version }}
       core_changed: ${{ steps.detect.outputs.core_changed }}
@@ -313,9 +310,8 @@ jobs:
     if: needs.release.result == 'success' && needs.release.outputs.core_changed == 'true' && inputs.skipModuleBump != true
     uses: ./.github/workflows/auto-bump-modules.yml
     permissions:
-      contents: write   # required for pushing bump branch / PR
-      pull-requests: write
-      actions: read
+      contents: write      # push bump branch & tag refs
+      pull-requests: write # open/update PR
     with:
       coreVersion: ${{ needs.release.outputs.released_version }}
     secrets: