Potential fix for code scanning alert no. 9: Workflow does not contain permissions

[bixu]

Potential fix for https://github.com/bixu/apiary/security/code-scanning/9

To fix the problem, we should add an explicit permissions block to the workflow file, preferably at the top level so it applies to all jobs unless overridden. The minimal set of permissions required should be declared, following the principle of least privilege. For this workflow, which involves managing releases (creating, uploading, publishing), and triggering repository dispatch events, the following permissions are likely required:

• contents: write (for creating and modifying releases)
• actions: read (basic action execution)
• Optionally, for improved granularity, you could specify additional permissions for dispatch, but contents: write covers most needs for release and dispatch.

Add the following block after the name: line and before the on: block:

permissions:
  contents: write

If it turns out you need, for example, pull-requests: write for other purposes, you can add that. But for this workflow, contents: write suffices.

Change to be made:

• Add the above permissions: block at the top of .github/workflows/release.yml, between name: Release and line 3 (on:).

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.