Least-privilege GITHUB_TOKEN permissions in workflows
Why it matters
Without a permissions block the workflow token may have write access to the whole repository. Any step that is compromised — a dependency, an action — inherits it.
How to fix it
Declare the minimum at the top of each workflow, and widen it only on the job that needs more:
permissions:
contents: read
pull-requests: write # only where it is actually used
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Related checks
- How to find and remove secrets committed to a Git repository
- Why .env must be in .gitignore (and how to check it is not already committed)
- A .env file is committed to the repository: what to do
- Automated dependency updates with Dependabot or Renovate
- How to pin GitHub Actions to a commit SHA
- The pull_request_target trap in GitHub Actions