security: narrow the release token to the job that needs it (#34)

The workflow held contents: write for its whole run. It now runs with
contents: read and grants write only to the job that publishes the
release.

OpenSSF Scorecard scores Token-Permissions 0 out of 10 whenever any
workflow carries a top-level write permission, however little of the run
needs it. This one line was what held the check at zero.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 9t29zhmwdh-coder

.github/workflows/release.yml

@@ -12,12 +12,17 @@ on:
         default: "0.0.0-dev"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build-installer:
     name: Build Windows Installer
     runs-on: windows-latest
+    permissions:
+      # Nur was ueber das workflow-weite contents: read hinausgeht.
+      # Read-Rechte hier zu wiederholen ist das, was OpenSSF Scorecard
+      # als zu weite Token-Berechtigung bemaengelt.
+      contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to NetDashboard will be documented here.
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [1.0.5] - 2026-07-29
+
+### Security
+
+- The release workflow no longer grants `contents: write` for its whole run. The permission moves to the one job that publishes the release, and everything else runs with `contents: read`. OpenSSF Scorecard scores the Token-Permissions check 0 out of 10 whenever any workflow holds a top-level write permission, regardless of how little of the run needs it, so this single line was what held the check at zero.
+
+---
+
 ## [1.0.4] - 2026-07-29
 
 ### Changed

NetDashboard.csproj

@@ -8,7 +8,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <UseWPF>true</UseWPF>
     <ApplicationIcon>RayStudio.ico</ApplicationIcon>
-    <Version>1.0.4</Version>
+    <Version>1.0.5</Version>
     <EnableWindowsTargeting>true</EnableWindowsTargeting>
   </PropertyGroup>