fix: add permissions to release workflow build job

[Anshgrover23]

Summary

• Add explicit permissions: contents: read to the build job in the release workflow
• Resolves CodeQL security alert ## Testing & Integration Bounties Available #19 about missing workflow permissions
• Follows the principle of least privilege by limiting GITHUB_TOKEN scope

Test plan

• Verify the workflow syntax is valid
• Confirm the release workflow still triggers correctly on release events

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow configuration for improved build reliability.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR addresses a CodeQL security alert by adding explicit permissions to the release workflow's build job, implementing the principle of least privilege for the GITHUB_TOKEN.

Changes:

• Added permissions: contents: read to the build job in the release workflow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request modifies the GitHub Actions release workflow by adding a permissions block to the build job that grants contents read access, and inserts a formatting blank line before the Publish to PyPI step.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration \.github/workflows/release\.yml	Added permissions block to build job with contents: read and inserted blank line before Publish to PyPI step for formatting

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• fix: resolve CodeQL security alerts #302: Also modifies GitHub Actions workflow permissions by adding a permissions block granting contents read access.

Suggested reviewers

• mikejmorgan-ai
• Suyashd999

Poem

🐰 A rabbit hops through workflows with care,
Permissions granted with flair,
Build jobs now read with grace,
CI/CD finds its place,
Code flows through the autumn air! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is incomplete. The PR is missing the required 'Related Issue' section with issue number, and the checklist section is entirely absent.	Add a 'Related Issue' section with issue #19 reference, and complete the checklist with PR title format confirmation, test verification status, and AI disclosure checkbox.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding permissions to the release workflow build job, which is the primary purpose of this changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[divanshu-go]

LGTM!