Update to automatically publish to PyPI on release

[jacquelynsmale]

No description provided.

To fix this issue, you should explicitly add a permissions key at the root of the workflow file or within the job definition. Since the job refers to a reusable workflow, and unless specific permissions are required by the called workflow (not shown), the best practice is to set the minimal set: contents: read. This ensures the workflow runs with read-only access by default. If the called reusable workflow requires additional write privileges (for example, to issues or pull-requests), you would need to expand this block accordingly, but contents: read is a secure baseline.

Edit the .github/workflows/changelog.yml file, inserting the following block after the name and before the on block:

permissions:
  contents: read

No additional methods, imports, or dependencies are required.

The best fix is to add a permissions block specifying the minimal set of privileges needed for the job.
This should be added to the job definition (under call-labeled-pr-check-workflow:) or at the root of the workflow (covering all jobs).

Since the workflow only uses a reusable workflow and does not perform any write operations itself, the safe minimal starting point is contents: read, unless the called workflow requires broader permissions.
If the reusable workflow needs more, adjust accordingly, but for minimal compliance, start with:

permissions:
  contents: read

This block should be indented to match the job level if placed under the job.

---