chore: package permissions for tag-release

Author: tstephen-nhs

.github/workflows/pull_request.yml

@@ -49,9 +49,9 @@ jobs:
     needs: get_config_values
     uses: ./.github/workflows/tag-release-devcontainer.yml
     permissions:
-      packages: write
       id-token: write
       contents: write
+      packages: write
     with:
       dry_run: true
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

.github/workflows/release.yml

@@ -32,6 +32,7 @@ jobs:
     permissions:
       id-token: write
       contents: write
+      packages: write
     with:
       dry_run: false
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

README.md

@@ -174,6 +174,10 @@ jobs:
   tag_release:
     uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
     needs: [get_config_values]
+    permissions:
+      id-token: write
+      contents: write
+      packages: write
     with:
       tag_format: "v\\${version}-beta"
       dry_run: true