Question

A workflow only needs to read repository code, build it, and post a comment on the triggering pull request. Your security team requires the automatically provided GITHUB_TOKEN to follow least-privilege principles. Which top-level configuration grants exactly the minimum required permissions?

Accepted Answer

permissions:
  contents: read
  pull-requests: write

Answer

permissions: read-all

Answer

permissions: write-all

Answer

permissions:
  contents: write
  issues: write