CI Permissions - dd-octo-sts - Use tag ref instead of branch

.github/chainguard/self.release.create-pr.sts.yml

@@ -1,13 +1,13 @@
 issuer: https://token.actions.githubusercontent.com
 
-subject: repo:DataDog/stratus-red-team:ref:refs/heads/main
+subject: repo:DataDog/stratus-red-team:ref:refs/(heads/main|tags/.*)
 
 claim_pattern:
   event_name: push
-  ref: refs/heads/main
+  ref: refs/(heads/main|tags/.*)
   ref_protected: "true"
-  job_workflow_ref: DataDog/stratus-red-team/.github/workflows/release.yml@refs/heads/main
+  job_workflow_ref: DataDog/stratus-red-team/.github/workflows/release.yml@refs/(heads/main|tags/.*)
 
 permissions:
   contents: read
-  pull-requests: read
+  pull_requests: write

.github/workflows/release.yml

@@ -9,6 +9,10 @@ defaults:
   run:
     working-directory: ./v2
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   goreleaser:
     timeout-minutes: 120