- Validate GitHub Actions workflows and set minimum required permissions

[Copilot]

Summary

Audited all GitHub Actions workflows and applied security best practices by restricting permissions to the required minimum.

Changes

check-dockerfile.yml

• Added permissions: contents: read — the only permission needed for actions/checkout and docker build.

publish.yml

• Added permissions: contents: read + packages: write — minimum required for checkout and pushing images to GHCR.
• Replaced secrets.SECRET_TOKEN (a long-lived Personal Access Token) with secrets.GITHUB_TOKEN (a short-lived, automatically provisioned token). This eliminates the need to manage a separate secret and follows the principle of least privilege.

Security Summary

No vulnerabilities introduced. All changes reduce the attack surface by:

1. Explicitly scoping workflow permissions instead of relying on the default (which can be read-write depending on repository settings).
2. Using the ephemeral GITHUB_TOKEN instead of a stored PAT for GHCR authentication.

[mtracz]

After this PR SECRET_TOKEN repo secret can be removed.