fix zizmor findings

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

.github/workflows/publish.yml

@@ -1,13 +1,12 @@
 name: publish
 
-permissions:
-  id-token: write # required for OIDC
-  contents: write # required to create GitHub Release
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -19,10 +18,13 @@ env:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for OIDC
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Enable corepack
         run: |
@@ -30,7 +32,7 @@ jobs:
           yarn --version
       -
         name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'yarn'
@@ -51,11 +53,3 @@ jobs:
         run: |
           npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
           npm publish --provenance --access public
-      -
-        name: Create Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe  # v2.6.1
-        with:
-          draft: true
-          generate_release_notes: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}