message: build: harden release.yml permissions
diff: @@ -7,8 +7,12 @@ on:
  description: 'Tag to prepare'
  required: true
  default: 'v5-09-XXy-01'
  +permissions: {}
  jobs:
  build:
  + permissions:
  + contents: write # for git push
  +
  runs-on: ubuntu-latest
  steps:
  