Merge pull request #70 from github-community-projects/jm_workflow_permissions

fix: add permissions to ci actions workflow

Author: jmeridth

.github/workflows/ci.yml

@@ -1,5 +1,7 @@
 name: CI
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   build:
     name: Test on Ruby ${{ matrix.ruby_version }}, Rails ${{ matrix.rails_version }}, graphql-ruby ${{ matrix.graphql_version }}

.github/workflows/release.yml

@@ -3,12 +3,12 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+permissions:
+  contents: write
+  id-token: write
 jobs:
   release:
     name: Release to RubyGems
-    permissions:
-      contents: write
-      id-token: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4