What is the default permission level of GITHUB_TOKEN when the repository's 'Workflow permissions' setting is set to 'Read and write permissions'?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When the repository setting is 'Read and write', GITHUB_TOKEN starts with broad write access — then you should restrict it per workflow.
Full explanation below image
Full Explanation
The 'Workflow permissions' setting in Repository Settings > Actions > General controls the default GITHUB_TOKEN permission level. 'Read and write permissions' grants GITHUB_TOKEN read and write access to all available scopes by default. 'Read repository contents and packages permissions' restricts to read-only. Individual workflows can still use the 'permissions:' block to further restrict or (if the setting allows) broaden permissions for specific jobs. GitHub's security recommendation is to set the default to read-only and grant specific write permissions only where needed in workflow files.