ci: Granular workflow permissions

.github/workflows/build.yml

@@ -16,9 +16,6 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci.yml

@@ -7,5 +7,7 @@ on:
 jobs:
   build:
     uses: ./.github/workflows/build.yml
+    permissions:
+      contents: read
     with:
       push-to-registry: false

.github/workflows/publish.yml

@@ -14,6 +14,10 @@ env:
 jobs:
   build:
     uses: ./.github/workflows/build.yml
+    permissions:
+      contents: read
+      packages: write
+    secrets: inherit
     with:
       push-to-registry: true