Right permissions

Author: stevebux

.github/workflows/stage-3-build.yaml

@@ -38,7 +38,7 @@ on:
 
 permissions:
   id-token: write # This is required for requesting the JWT
-  contents: write # This is required for actions/checkout and uploading release assets
+  contents: read # This is required for actions/checkout
   packages: read # This is required for downloading from GitHub Package Registry
 
 jobs:

.github/workflows/stage-5-publish.yaml

@@ -228,7 +228,7 @@ jobs:
     needs: [publish]
     permissions:
       id-token: write # This is required for requesting the JWT
-      contents: read # This is required for actions/checkout
+      contents: write # This is required for publishing release asset
     timeout-minutes: 10
     strategy:
       matrix: