Add the contents: write permission to the publish job
MODIFY
.github/workflows/publish.yml
.github/workflows/publish.yml
@@ -65,6 +65,8 @@ jobs:
name: "Publish"
if: startsWith(github.ref, 'refs/tags/')
needs: ["build", "provenance"]
+ permissions:
+ contents: write
runs-on: "ubuntu-latest"
steps:

Add the contents: write permission to the publish job