chore: default read permissions

Author: fengmk2

.github/workflows/release.yml

@@ -2,12 +2,17 @@ name: Release
 
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - 09-17-chore_default_read_permissions
 
 permissions: {}
 
 jobs:
   build-rust:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -121,7 +126,7 @@ jobs:
           sed -i 's/"version": "0.0.0"/"version": "0.0.0-${{ github.sha }}"/' packages/cli/package.json
 
       # Setup node correctly for publishing to github registry
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: .node-version
           registry-url: "https://npm.pkg.github.com"