security: add least-privilege permissions to release workflows

[intel352]

Summary

Fixes CodeQL actions/missing-workflow-permissions MEDIUM alerts in two release workflows by adding a top-level permissions: {} deny-all default and explicit least-privilege permissions: blocks on each job.

No workflow logic was changed — only permissions: keys were added.

Permissions added per job

release.yml

Top-level (new):

permissions: {}

Denies all scopes by default; jobs below grant only what they need.

release job (was flagged ~line 46):

permissions:
  contents: write      # gh release create, upload asset, git push branch for module-path PR
  pull-requests: write # gh pr create for v2+ module-path update

Reasoning: the Create release step runs gh release create … "$ARCHIVE" (uploads asset → contents: write). The Create PR for module path update step runs git push origin "$BRANCH_NAME" and gh pr create → both need contents: write + pull-requests: write.

bump-modules job (was flagged ~line 441):

permissions:
  contents: write      # callee commits, pushes branch, and merges PR
  pull-requests: write # callee creates and merges the bump PR
  actions: read        # callee reads workflow run status
  checks: write        # callee writes check results

Reasoning: bump-modules is a uses: delegation to auto-bump-modules.yml, which already declares these four scopes in its own top-level permissions: block. When a reusable workflow is called, the caller's GITHUB_TOKEN permissions bound what the callee receives — so the caller must carry at least the scopes the callee needs.

---

module-release.yml

Top-level (new):

permissions: {}

prepare-release job (read-only prep):

permissions:
  contents: read       # checkout + git tag list + find modules directory

Reasoning: this job only reads the repo (checkout, git tag -l, find modules). No writes anywhere.

release-module job (was flagged ~line 104):

permissions:
  contents: write      # gh release create, git push origin "$TAG", git push branch for module-path PR
  pull-requests: write # gh pr create for v2+ module-path update

Reasoning: the Create release step runs gh release create and then git push origin "$TAG" (tag push → contents: write). The Create PR for module path update step runs git push origin "$BRANCH_NAME" and gh pr create → contents: write + pull-requests: write.

Test plan

• YAML validates cleanly (python3 -c "import yaml; yaml.safe_load(open(f))" passes for both files — confirmed locally before push)
• Trigger Release workflow (workflow_dispatch) on a patch bump and confirm the release job and bump-modules job both complete successfully
• Trigger Module Release workflow and confirm prepare-release + release-module both complete successfully
• Confirm CodeQL actions/missing-workflow-permissions alerts are resolved after the next scan

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!