Add proper permissions for release workflow

.github/workflows/publish-docker-image.yml

@@ -43,7 +43,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=sha,event=workflow_dispatch,enable=${{ !startsWith(github.ref, 'refs/tags/') }}
             type=semver,pattern={{version}}
           labels: |
             org.opencontainers.image.title=HealthyCode
@@ -67,10 +66,11 @@ jobs:
             ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
+          provenance: false
 
       - name: Generate artifact attestation for Docker image
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  #  v4.1.0
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
+          push-to-registry: true

.github/workflows/pypi-release.yml

@@ -49,11 +49,14 @@
           path: dist/*
 
 
-  create-gh-release:
-    name: Create GH release
+  create-pypi-release:
+    name: Create PyPI release
     needs:
-      - build-pypi-distribs
+      - create-gh-release
     runs-on: ubuntu-24.04
+    environment: pypi-publish
+    permissions:
+      id-token: write
 
     steps:
       - name: Download built archives
@@ -62,21 +65,18 @@
           name: pypi_archives
           path: dist
 
-      - name: Create GH release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
-        with:
-          draft: true
-          files: dist/*
+      - name: Publish to PyPI
+        if: startsWith(github.ref, 'refs/tags')
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
 
 
-  create-pypi-release:
-    name: Create PyPI release
+  create-gh-release:
+    name: Create GH release
     needs:
-      - create-gh-release
+      - build-pypi-distribs
     runs-on: ubuntu-24.04
-    environment: pypi-publish
     permissions:
-      id-token: write
+      contents: write
 
     steps:
       - name: Download built archives
@@ -85,6 +85,8 @@
           name: pypi_archives
           path: dist
 
-      - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+      - name: Create GH release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
+        with:
+          draft: true
+          files: dist/*