Question

A workflow builds a container image and pushes it to GitHub Container Registry (ghcr.io) using the automatically provided GITHUB_TOKEN. The workflow also runs a linter and a test job that only need to read repository contents. Your security team requires that the workflow follow least-privilege for the GITHUB_TOKEN. What is the most appropriate way to configure permissions?

Accepted Answer

Set a minimal top-level permissions: { contents: read } baseline and, on the publishing job only, set permissions: { contents: read, packages: write } (a job-level permissions block replaces the default, so contents: read must be restated for checkout).

Answer

Set top-level permissions: write-all so every job can push if needed, relying on branch protection to prevent misuse.

Answer

Replace GITHUB_TOKEN with a personal access token (PAT) stored as a secret and grant it write:packages scope for all jobs.

Answer

Leave permissions unset so the workflow inherits the repository default, which is always read-only for all scopes.