Which GitHub Actions permission allows a workflow to create and update issues and pull requests?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub Actions uses granular permission scopes. To touch issues and PRs from a workflow, you need the specific 'issues: write' and 'pull-requests: write' permissions. The 'contents' permission is for repository file content, not issues.
Full explanation below image
Full Explanation
GitHub Actions workflow permissions are granular and follow the principle of least privilege. Each permission type controls a specific resource: 'contents' controls read/write to repository files, code, commits; 'issues' controls creating, editing, and commenting on issues; 'pull-requests' controls creating, editing PRs and reviews; 'actions' controls interacting with workflow runs; 'packages' controls GitHub Packages. When configuring the 'permissions:' block in a workflow, you specify each permission type independently. Setting one permission to 'write' does not grant write to other resource types. For a bot that creates issues and comments on PRs, you'd configure both 'issues: write' and 'pull-requests: write'.