Update release pipeline

Signed-off-by: Josef Karasek <karasek.jose@gmail.com>

Author: josefkarasek

.github/workflows/pr-check.yaml

@@ -4,6 +4,13 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+  checks: write
+  security-events: write
+  actions: read
+
 jobs:
   pr-check:
     uses: kedify/github-meta/.github/workflows/go-pr-check.yaml@main

.github/workflows/release.yaml

@@ -4,15 +4,13 @@ on:
   push:
     tags:
       - "v*"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
 
     steps:
       - name: Checkout
@@ -29,7 +27,6 @@ jobs:
         uses: sigstore/cosign-installer@v3
 
       - name: Run GoReleaser release
-        if: github.event_name == 'push'
         uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
@@ -38,13 +35,3 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
-
-      - name: Run GoReleaser snapshot
-        if: github.event_name == 'workflow_dispatch'
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          distribution: goreleaser
-          version: "~> v2"
-          args: release --clean --snapshot
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}