Question

A workflow in the `web-app` repository needs to check out and read files from a separate private repository, `shared-config`, during its build. The engineer configures the default `GITHUB_TOKEN` with `contents: read` permission and passes it to the checkout step targeting `shared-config`, but the step fails with an authentication/permission error. What is the correct explanation and remediation?

Accepted Answer

The GITHUB_TOKEN is scoped only to the repository running the workflow, so it cannot access `shared-config`; use a fine-grained PAT (or GitHub App token) with read access to `shared-config` stored as a secret.

Answer

The GITHUB_TOKEN can access any private repo in the org by default; the failure is because `contents: read` must be `contents: write` for checkout to authenticate.

Answer

Add `id-token: write` to the job so the GITHUB_TOKEN can federate to the other repository via OIDC.

Answer

Set `permissions: read-all` at the workflow level, which automatically extends the GITHUB_TOKEN's scope to all repositories in the organization.