ci: align with kubernetes-etcd-backup (#101)

* chore: add YAML separator

* ci: use GITHUB_TOKEN for semantic release

* ci: add package write permissions to release-container-image

Author: tongpu

.github/workflows/release-container-image.yaml

@@ -1,3 +1,4 @@
+---
 name: Release Container Image
 
 on:
@@ -11,6 +12,8 @@ on:
 
 jobs:
   container:
+    permissions:
+      packages: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -42,7 +45,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
+          username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
         if: ${{ github.event_name != 'pull_request' }}
 
@@ -62,7 +65,6 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
 
       - name: Build and push
-        id: docker_build_ghcr
         uses: docker/build-push-action@v6
         with:
           context: .

.github/workflows/semantic-release.yaml

@@ -1,3 +1,4 @@
+---
 # runs on each push to main and is responsible for creating new tags/releases
 name: Create Semantic Release
 
@@ -9,6 +10,8 @@ on:
 jobs:
   semantic-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -18,5 +21,5 @@ jobs:
         id: semrel
         uses: go-semantic-release/action@v1.24
         with:
-          github-token: ${{ secrets.PAT }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           allow-initial-development-versions: true

.github/workflows/shellcheck.yaml

@@ -1,3 +1,4 @@
+---
 name: Shellcheck
 on: pull_request
 jobs: