A program manager automates a weekly portfolio summary every Monday at 8am that reads project boards, needs read-only repo access, and posts a markdown report as a job artifact. Which workflow configuration correctly sets schedule, permissions, and output for this agentic workflow?
Select an answer to reveal the explanation.
Short Explanation
You've got a clock, a key, and a delivery box to get right. Least privilege works like giving a courier lobby access only, enough to deliver without roaming the building.
Full Explanation
The correct configuration matches schedule, authorization, and output together: cron provides reliable unattended execution every Monday at 8am, read-only permissions satisfy least privilege for reading project boards and repositories without write risk, and uploading the markdown as a job artifact ensures the report is retained with the run for download and audit. One distractor fails on scheduling because push-triggered execution is ideal for continuous integration but runs on every commit and cannot guarantee a single weekly Monday summary, creating extra runs and missing the time requirement. Another distractor fails on permissions because read and write access is common when workflows must update issues or push changes, yet this scenario explicitly needs read-only repo access, so broader scopes violate least privilege and increase risk. The remaining distractor fails on delivery because publishing a release is a sound pattern for versioned customer notes, yet a release is not a run-scoped artifact and does not meet the requirement to store the internal report as a job artifact. As an exam caveat, watch for stems that test trigger vocabulary versus permission scope versus persistence mechanism in the same item, so map each phrase separately. As a practical check, run the workflow on a test branch, inspect the effective permissions, and confirm the artifact appears and renders correctly.