chore(ci): migrate release workflow to GitHub keyless auth

[matiasinsaurralde]

Summary

Migrate release workflow to use GitHub keyless attestation.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:9">
P2: Avoid `read-all` here; it broadens the default `GITHUB_TOKEN` for every job beyond what this workflow needs. Keep the top-level token limited and let the individual jobs request any extra scopes they require.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Avoid read-all here; it broadens the default GITHUB_TOKEN for every job beyond what this workflow needs. Keep the top-level token limited and let the individual jobs request any extra scopes they require.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.yaml, line 9:

<comment>Avoid `read-all` here; it broadens the default `GITHUB_TOKEN` for every job beyond what this workflow needs. Keep the top-level token limited and let the individual jobs request any extra scopes they require.</comment>

<file context>
@@ -6,8 +6,7 @@ on:
 # https://github.com/ossf/scorecard/blob/7ed886f1bd917d19cb9d6ce6c10e80e81fa31c39/docs/checks.md#token-permissions
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
</file context>