Backport workflow-hardening fix (excessive-permissions) to 3 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/release.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 18c8f7e

Affected release branches (3)

• release/v24.x (still present as of HEAD dbf4d127)
• release/v23.x (still present as of HEAD b3a5d119)
• release/v22.x (still present as of HEAD 087ac5f4)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/v24.x — excessive-permissions

File .github/workflows/release.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,3 +35,6 @@
       - name: Cleanup
         run: |
           sudo rm -rf dist
+    permissions:
+      contents: write
+      packages: write

release/v23.x — excessive-permissions

File .github/workflows/release.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,3 +35,6 @@
       - name: Cleanup
         run: |
           sudo rm -rf dist
+    permissions:
+      contents: write
+      packages: write

release/v22.x — excessive-permissions

File .github/workflows/release.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,3 +35,6 @@
       - name: Cleanup
         run: |
           sudo rm -rf dist
+    permissions:
+      contents: write
+      packages: write

---

Happy to open pull requests instead if that's preferred.