Would you merge this workflow permissions change?

Situation

A team member proposes a release workflow that builds and uploads artifacts on every push to main.

Environment

GitHub Actions with default token authentication.

Select suspicious lines in the terminal to flag them before submitting your verdict.

pending review

name: release
on:
  push:
    branches: [main]
permissions: write-all
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/