Apply least-privilege permissions to GitHub Actions workflow

[Copilot]

Addresses security feedback to restrict workflow permissions following the principle of least privilege.

Changes

• Set workflow-level permissions to contents: read (default for all jobs)
• Override with contents: write at job-level for release job only

This ensures test and build jobs run with read-only access, while only release retains write permissions needed for creating GitHub releases.

# Workflow level - default for all jobs
permissions:
  contents: read

jobs:
  release:
    # Job level - override only where needed
    permissions:
      contents: write

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR tightens the GitHub Actions workflow token permissions to follow least-privilege by defaulting to read-only repository contents access and elevating permissions only for the release job.

Changes:

• Set workflow-level permissions to contents: read
• Add job-level override permissions: contents: write for the release job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Setting workflow-level permissions to only contents: read implicitly sets all other GITHUB_TOKEN permissions to none. This workflow uses actions/cache@v4 and actions/upload-artifact@v4 / actions/download-artifact@v4, which require actions: write (cache save/upload) and at least actions: read (download). As-is, the test/build/release jobs may start failing with permission errors. Add the minimal required actions: permission at workflow level and/or per job (e.g., grant actions: write to jobs that save cache/upload artifacts, and actions: read to jobs that only download).

[Copilot]

The release job overrides contents: write but still inherits actions: none from the workflow-level permissions. Since this job uses actions/download-artifact@v4, it needs actions: read (or actions: write) to fetch artifacts; otherwise the download step can fail. Add actions: read to the release job's permissions block (and keep contents: write).

Suggested change

	contents: write
	contents: write
	actions: read