GitHub recommends setting 'Workflow permissions' to what default for new repositories?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub's security recommendation is read-only by default — then grant specific write permissions only where workflows actually need them.
Full explanation below image
Full Explanation
GitHub's security best practice guidance recommends setting the default 'Workflow permissions' to 'Read repository contents and packages permissions' (read-only) and explicitly granting write permissions in individual workflows using the 'permissions:' block. This implements the principle of least privilege — workflows only have the access they need for their specific tasks. A bug or compromised action in a read-only workflow can't push code, create releases, or modify issues. 'No permissions' isn't a valid option — GITHUB_TOKEN always has at minimum metadata:read. The 'Read and write' default is convenient but less secure.