docs: update actions and workflows documentation

[skip ci]

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: hoverkraft-bot[bot]

.github/workflows/release.md

@@ -3,7 +3,7 @@
 # GitHub Reusable Workflow: Node.js Release
 
 <div align="center">
-  <img src="https://opengraph.githubassets.com/64be3a16895705ee5048b06c8850eeece9322d7a637127269eb768810b96a0ac/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Release" />
+  <img src="https://opengraph.githubassets.com/9c8929c94966c12376f44be8244f2644ab06a7edbd6c23fef13493d4565c4c61/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Release" />
 </div>
 
 ---
@@ -47,7 +47,10 @@ permissions: {}
 jobs:
   release:
     uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/release.yml@47891dc49a31209a88949e081d97a010f8cd20c4 # 0.23.2
-    permissions: {}
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
     secrets:
       # GitHub token to use for authentication.
       # Defaults to `GITHUB_TOKEN` if not provided.
@@ -76,9 +79,9 @@ jobs:
 
       # npm distribution tag for the published package.
       # Common values:
-      # - `latest` — Default tag for stable releases
-      # - `next` — prerelease or beta versions
-      # - `canary` — Canary/nightly builds
+      # - `latest` - Default tag for stable releases
+      # - `next` - Prerelease or beta versions
+      # - `canary` - Canary/nightly builds
       #
       # See https://docs.npmjs.com/adding-dist-tags-to-packages.
       #