An agent has merged a pull request and now needs to trigger a downstream integration test workflow in the same repository. The downstream workflow is defined in .github/workflows/integration-tests.yml and is configured with workflow_dispatch as a trigger. Which MCP tool call and token permission combination is required for the agent to trigger this workflow?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Triggering a workflow_dispatch event via the API is an Actions-layer operation, not a Workflows-layer operation — the Workflows permission controls reading and modifying workflow files, while Actions permission controls triggering and managing workflow runs. Think of Workflows as the recipe and Actions as turning on the oven. The exam tests whether you know the difference.
Full explanation below image
Full Explanation
GitHub's permission model distinguishes between modifying workflow definitions (the YAML files) and triggering or managing workflow runs (the actual executions). These are controlled by different permission scopes.
Option A is wrong. Committing a change to the workflow file to force a trigger event is a hack, not a proper invocation method. It would modify the workflow's content unnecessarily, generate unwanted git history, potentially break the workflow if the commit introduces any syntax issues, and would trigger the workflow based on the push trigger (if configured) rather than workflow_dispatch. This is not the appropriate way to programmatically trigger a workflow.
Option B is wrong. The create_check_run tool creates a check run entry in GitHub's Checks system — it does not trigger workflow executions. Check runs are status indicators associated with commits; they are created by CI systems reporting their results, not used to initiate workflows.
Option C is subtly wrong in a way the exam specifically tests. A Workflows: write permission grants the ability to create, modify, and delete workflow YAML files in the .github/workflows/ directory. It does not grant the ability to trigger workflow runs. This is a common confusion because the permission sounds like it should cover triggering workflows.
Option D is correct. Triggering a workflow_dispatch event via the GitHub REST API (POST to /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches) requires the Actions: write permission, not Workflows: write. The GitHub MCP server exposes this capability through a workflow dispatch tool. This is the correct, intended mechanism for programmatically triggering a workflow_dispatch-enabled workflow from an agent.