chore: default read permissions

fengmk2 · fengmk2 · commit f709303d5ddc · 2025-09-17T20:51:06.000+08:00
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -2,8 +2,13 @@ name: Release
 
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - 09-17-chore_default_read_permissions
 
-permissions: {}
+permissions:
+  # Doing it explicitly because the default permission only includes metadata: read.
+  contents: read
 
 jobs:
   build-rust:
