Question

A workflow in your repository builds a container image and then attempts to create a GitHub Release using a release step (for example the gh CLI). The workflow file contains a top-level `permissions:` block set to `contents: read` and no other scopes. The build steps succeed, but the release-creation step fails with a 403 error. Your security team requires you to grant only the minimum additional access needed for this job to succeed, without loosening the default token behavior elsewhere. What is the most appropriate change?

Accepted Answer

Add `contents: write` to the workflow's `permissions:` block so the GITHUB_TOKEN can create the release.

Answer

Replace the GITHUB_TOKEN with a personal access token (PAT) stored as a secret, since GITHUB_TOKEN cannot create releases.

Answer

Set the workflow `permissions:` block to `write-all` to ensure the release step and any future steps have needed access.

Answer

Remove the `permissions:` block entirely so the token falls back to the repository's default permissive scope.