chore: default read permissions

Author: fengmk2

.github/workflows/release.yml

@@ -2,12 +2,17 @@ name: Release
 
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - 09-17-chore_default_read_permissions
 
 permissions: {}
 
 jobs:
   build-rust:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -103,12 +108,6 @@ jobs:
           pattern: cli
           merge-multiple: true
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          path: packages/global/dist
-          pattern: bindings-*
-          merge-multiple: true
-
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: packages/cli/dist
@@ -121,7 +120,7 @@ jobs:
           sed -i 's/"version": "0.0.0"/"version": "0.0.0-${{ github.sha }}"/' packages/cli/package.json
 
       # Setup node correctly for publishing to github registry
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: .node-version
           registry-url: "https://npm.pkg.github.com"

packages/global/package.json

@@ -22,12 +22,12 @@
     "snap-test": "snap-test"
   },
   "dependencies": {
+    "@voidzero-dev/vite-plus": "workspace:*",
     "oxlint": "catalog:",
     "rolldown-vite": "catalog:",
     "vitest": "catalog:"
   },
   "devDependencies": {
-    "@voidzero-dev/vite-plus": "workspace:*",
     "@voidzero-dev/vite-plus-tools": "workspace:",
     "rolldown": "catalog:"
   },