ci: add permissions to make a release

follow-up to https://github.com/systemd/systemd/pull/27071
in order to create Github Releases, the job needs permissions to write
contents

also:
- pinned the `softprops/action-gh-release` action to a specific commit
- made it only active on the `systemd` organization repos (so not on
  forks)

diff --git a/.github/workflows/make_release.yml b/.github/workflows/make_release.yml
index 47dbbea374ae864c5ee87def6e1261a4423d4931..c789d33f16e3c3cbd004cb9a270871dd4d06ffc4 100644 (file)
--- a/.github/workflows/make_release.yml
+++ b/.github/workflows/make_release.yml
@@ -5,14 +5,20 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: ${{ github.repository_owner == 'systemd' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
         with:
           prerelease: ${{ contains(github.ref_name, '-rc') }}
           draft: ${{ github.repository == 'systemd/systemd' }}