fix: update permissions for PyPI publishing workflow (#4)

Author: fcakyon

.github/workflows/publish.yml

@@ -10,20 +10,20 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
-      # IMPORTANT: this permission is mandatory for Trusted Publishing
-      id-token: write
+      id-token: write  # for PyPI Trusted Publishing
+      contents: read  # for actions/checkout to access private repo
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Setup uv python package manager
         uses: astral-sh/setup-uv@v6
         with:
           python-version: "3.12"
           enable-cache: true
-          
+
       - name: Build package distributions
         run: |
           uv build
-          
+
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1