The release workflow's CI job was missing `actions: read` and `security-events: write` permissions, which are required for certain CI steps (e.g. uploading SARIF results or reading workflow artifacts). Change-Type: ci Release-Note: no Audience: internal Impact: low Breaking: false Co-authored-by: Claude <noreply@anthropic.com>