Question

Your security team wants every new repository in the organization to start with a GITHUB_TOKEN that has read-only access to repository contents by default, so that individual workflows must explicitly opt into any write scopes they need. Which configuration achieves this least-privilege baseline across the org without editing each workflow file?

Accepted Answer

In the organization's Actions settings, set the default workflow permissions for GITHUB_TOKEN to 'Read repository contents and packages permissions'.

Answer

Add 'permissions: read-all' at the top of every workflow file via a required starter workflow.

Answer

Replace GITHUB_TOKEN usage with a fine-grained PAT stored as an org secret scoped to read-only.

Answer

Enable 'Require approval for all outside collaborators' in the organization's Actions settings.