At what levels can you set the 'permissions:' block in a GitHub Actions workflow?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Permissions follow the principle of least privilege — set defaults at workflow level, then tighten or loosen per job as needed.
Full explanation below image
Full Explanation
The 'permissions:' block can be specified at the top level of the workflow (applies to all jobs) and/or at individual job level (overrides workflow-level for that job). Job-level permissions override workflow-level permissions completely — they don't merge. Setting 'permissions: {}' at workflow level denies all permissions, then individual jobs can grant only what they need. Step-level permissions don't exist — all steps in a job share the job's GITHUB_TOKEN permissions. Available scopes include contents, pull-requests, issues, packages, etc.