To fix the problem, we should add an explicit permissions section at the top level of the workflow (recommended for consistency and coverage, unless fine-grained per-job tuning is preferred). Start with the minimal set required: for workflows mainly reading source and uploading artifacts, and those using reusable workflows (which may require more), the base should be contents: read, possibly packages: write or actions: write if needed. A conservative starting point is to use contents: read, and as needed add additional write privileges to specific jobs. Since without changing functionality we can’t guess the least needed, adopt the minimal starting point as suggested by CodeQL.

Changes needed:

• Insert a permissions: block after the workflow name and before on:
• Use permissions: {} for absolute minimum starting (denies all except metadata), or contents: read (which is normally safe for most workflows unless writing is needed). Since jobs upload artifacts and potentially publish Docker images, some jobs may need broader permissions, but the initial fix is to add the recommended minimal block.
• All changes are in .github/workflows/nightly-release.yml.