feat: add publish workflow based on the fixed fork

[AtzeDeVries]

Signed-off-by: Atze de Vries atze.wiebe.de.vries@coop.no

In general, the fix is to add an explicit permissions: block that grants only the minimum scopes required to run the workflow. Since this job only calls a reusable workflow and passes secrets, the least-privilege starting point is usually contents: read. If the reusable workflow needs to push commits, create releases, or modify other resources, it should request those explicitly in its own file; the caller should not over‑grant by default.

The single best change here, without altering existing functionality, is to add a root‑level permissions: block just under the name: (or under on:), applying to all jobs in this workflow. As we don’t see any direct write operations in this snippet, we will set contents: read, which is safe and aligns with the recommended minimal starting point. If later turns out that the called workflow needs additional token scopes, they should be added explicitly there, not here.

Concretely, edit .github/workflows/publish-provider-package-alt.yml and insert:

permissions:
  contents: read

between the name: and the on: block (or equivalently between on: and jobs:), ensuring indentation is correct for a root‑level key.