Add permissions

.github/workflows/build-and-test.yaml

@@ -146,6 +146,13 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+      attestations: write
     needs:
     - build
     if: ${{ github.event_name != 'pull_request' }}