Question

Your team's GitHub Actions workflows use the automatically provided GITHUB_TOKEN to interact with the repository. A security review flags that the token has broad read/write access across many scopes by default, violating least-privilege requirements. The workflows only need to publish a package to GitHub Packages and post a comment on pull requests. What is the most effective way to restrict the token's access while keeping the workflows functional?

Accepted Answer

Set the default token permissions to read-only at the organization/repository level, then declare a top-level or job-level 'permissions' block granting only 'packages: write' and 'pull-requests: write'.

Answer

Replace GITHUB_TOKEN with a fine-grained personal access token (PAT) stored as a repository secret and reference it in each step.

Answer

Create a GitHub App installation token with full repository permissions and inject it into the workflow via the actions/create-github-app-token action.

Answer

Add 'permissions: write-all' at the workflow level so the token behavior is explicit and auditable in the workflow file.