chore: sets explicit permissions to actions

Author: ganchoradkov

.github/workflows/ci.yml

@@ -18,6 +18,9 @@ on:
 
 name: CI Checks
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: CI

.github/workflows/publish-pkg-canary.yml

@@ -17,10 +17,12 @@ on:
         description: "Specific version to publish (e.g., 1.2.3)"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    # The permissions block is removed as no step needs write access to the repository.
 
     steps:
       - name: Checkout code 🛎️

.github/workflows/publish-pkg-latest.yml

@@ -10,10 +10,12 @@ on:
         description: "Relative path to the package directory (e.g., misc/heartbeat)"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    # The permissions block is removed as no step needs write access to the repository.
 
     steps:
       - name: Checkout code 🛎️