A workflow only needs to read repository contents and write packages. Which permissions block best follows least privilege?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Set an explicit permissions map granting only contents: read and packages: write. Avoid write-all and broad default write scopes.
Full explanation below image
Full Explanation
The permissions key at workflow or job level scopes GITHUB_TOKEN. Explicit least privilege reduces blast radius if a workflow is compromised. write-all grants excessive access. Listing many unused write scopes violates least privilege. Omitting permissions falls back to repository/org default workflow permissions (often read or read/write depending on settings)—not org admin. Prefer workflow-level read defaults and elevate per job when needed. Pair with environment protection for deploy jobs.