A workflow only needs to read repository contents and packages; it must not write to issues or pull requests. Which permissions block best follows least privilege for GITHUB_TOKEN?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Set only the scopes you need at read. Avoid write-all or contents: write when the job merely consumes code and packages — least privilege reduces token abuse impact.
Full explanation below image
Full Explanation
The permissions key (workflow or job level) configures the GITHUB_TOKEN's fine-grained scopes such as contents, packages, issues, pull-requests, id-token, and others. Specifying contents: read and packages: read grants only those abilities. write-all grants broad write access and violates least privilege. contents: write allows pushes and other write content operations beyond the stated need. unrestricted is not a valid permissions value. GitHub and security guidance recommend defaulting workflow permissions to read and elevating per job only when required. Job-level permissions can narrow or adjust relative to workflow defaults depending on configuration. Auditing permissions blocks is a common hardening step for Actions security reviews.