chore(ci): update release.yml content write to read permission (#87) #238

	on:
	pull_request:
	types: [opened, synchronize, reopened]
	branches:
	- '**'
	push:
	branches:
	- 'main'

	permissions:
	id-token: write
	contents: read
	attestations: read

	name: CI Test, Typecheck, Benchmark
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}-test
	cancel-in-progress: true
	env:
	CI: true
	NODE_OPTIONS: --max-old-space-size=8192
	HUSKY: 0

	jobs:
	test:
	name: Test & Typecheck
	runs-on: macos-latest

	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Install pnpm
	run: npm install -g pnpm@9
	- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
	with:
	node-version: 20
	cache: 'pnpm'
	- name: Install dependencies
	run: pnpm install
	- name: Run typecheck
	run: pnpm run typecheck
	- name: Run test
	run: pnpm run coverage
	- name: Upload coverage data
	uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
	with:
	fail_ci_if_error: true
	disable_search: true
	files: ./coverage/lcov.info
	token: ${{ secrets.CODECOV_TOKEN }}
	verbose: false
	benchmark:
	name: Benchmark
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Install pnpm
	run: npm install -g pnpm@9
	- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
	with:
	node-version: 20
	cache: 'pnpm'
	- name: Install dependencies
	run: pnpm install
	- name: Run benchmark
	run: pnpm run test:bench

Provide feedback