Add top-level permissions to GitHub Actions workflows

[Copilot]

Code scanning flagged workflows missing explicit top-level permissions declarations, allowing default permissive GITHUB_TOKEN access.

Changes

• ci.yml: Added permissions: contents: read (resolves primary alert)
• release.yml: Added permissions: contents: read with job-level override to contents: write
• sync-release-notes.yml: Added permissions: contents: read with job-level override to contents: write

Result

All workflows now explicitly declare minimum required permissions at the top level, following principle of least privilege. Jobs requiring elevated permissions override as needed at job scope.

permissions:
  contents: read

jobs:
  release:
    permissions: 
      contents: write

Original prompt

Handle this code scanning alert:

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.