address automated review

Author: blink1073

.github/workflows/dist.yml

@@ -15,6 +15,10 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+  actions: read
+
 concurrency:
   group: dist-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/release-python.yml

@@ -58,12 +58,16 @@ jobs:
   build-dist:
     needs: [pre-publish]
     uses: ./.github/workflows/dist.yml
+    permissions:
+      contents: read
     with:
       ref: ${{ needs.pre-publish.outputs.version }}
 
   static-scan:
     needs: [pre-publish]
     uses: ./.github/workflows/codeql.yml
+    permissions:
+      contents: read
     with:
       ref: ${{ needs.pre-publish.outputs.version }}