Merge branch 'main' into chore/update-next-from-main

.github/workflows/release-orchestrator.yml

@@ -71,7 +71,7 @@ jobs:
   run-production:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.release-type == 'production' }}
     permissions:
-      contents: read
+      contents: write
       id-token: write
     uses: ./.github/workflows/release.yml
     secrets: inherit

.github/workflows/release.yml

@@ -54,6 +54,9 @@ jobs:
   finalize-release:
     needs: [release-ionic]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       with:
@@ -82,6 +85,9 @@ jobs:
     # possible for them to push at the same time.
     needs: [finalize-release]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         # Pull the latest version of the reference