ci: add read permission for contents (#1127)

Author: Belco90

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ jobs:
   verifications:
     name: Verifications
     uses: ./.github/workflows/verifications.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   required-checks:
     name: Require CI status checks

.github/workflows/release.yml

@@ -39,7 +39,6 @@ jobs:
         with:
           cache: 'pnpm'
           node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
 
       # Ensure npm 11.5.1 or later is installed for correct OIDC publishing
       - name: Update npm

.github/workflows/verifications.yml

@@ -2,6 +2,9 @@ name: Verifications
 
 on:
   workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 jobs:
   code-validation: