Summary

• remove id-token: write and attestations: write from the Bazel Central Registry release path
• keep contents: write, which is still needed for the BCR publish workflow to create release-side changes
• align the caller and reusable release workflow permissions with the existing attest: false setting

Security rationale

The Bazel release path passes attest: false to bazel-contrib/publish-to-bcr, so this workflow does not need GitHub OIDC token minting or GitHub artifact attestation write access. Dropping those scopes reduces the privileges available to the release job while preserving the publish token flow used for BCR updates.

Validation

• git diff --check
• /tmp/actionlint-bin/actionlint .github/workflows/release.yml .github/workflows/release-bazel.yml
• uvx zizmor --min-severity medium --min-confidence medium --format json .github/workflows/release.yml .github/workflows/release-bazel.yml

Note: zizmor still reports pre-existing unpinned action references in these release workflows. The excessive-permissions finding for this path is removed by this patch.