fix(ci): add explicit token permissions to workflows

[kwit75]

Summary

• Remove unnecessary packages: write from CI init and codeql (JS/Python) jobs that only need read access
• Remove overly broad permissions from CI build job (was listing 7 permissions, now only contents: read + packages: write for NuGet cache)
• Restrict release workflow top-level permissions from contents: write + packages: write to contents: read, adding explicit per-job permissions to init, build, and docker jobs
• publish job already had correct per-job permissions (contents: write + id-token: write)

Test plan

• CI workflow runs successfully on this PR (init, build, codeql jobs)
• Scorecard Token-Permissions alerts resolve for the flagged lines

Summary by CodeRabbit

• Chores
  • Updated continuous integration and release workflow configurations to reduce and reorganize system-level permissions, maintaining essential functionality while refining security configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a162e8d7-edc6-46f2-85ef-5e3c8060ffe1

📥 Commits

Reviewing files that changed from the base of the PR and between 6636ac5 and 4975ac0.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/release.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions workflow permissions are being reduced following the principle of least privilege. In ci.yml, redundant permissions are removed from jobs. In release.yaml, top-level permissions are minimized while per-job permissions are selectively re-added where needed.

Changes

Cohort / File(s)	Summary
CI Workflow Permissions .github/workflows/ci.yml	Removed redundant permissions from init, build, codeql, and codeql-cpp jobs (packages: write, actions: read, checks: read, pull-requests: write, repository-projects: read, security-events: read, statuses: read). Retained essential permissions (contents: read, packages: write where applicable).
Release Workflow Permissions .github/workflows/release.yaml	Reduced top-level workflow permissions from write (contents, packages) to read (contents). Added per-job permission blocks restoring contents: read for init, build, and docker jobs, and packages: write for build and docker jobs.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Permissions trimmed with careful shears,
Least privilege now makes workflows clear,
Each job gets just what it needs to do,
Security tightened, access reviewed anew! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(ci): add explicit token permissions to workflows' accurately summarizes the main changes: reducing overly permissive GitHub Actions token permissions and adding explicit per-job permissions in ci.yml and release.yaml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-ci-workflows

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}