Workflows declare least-privilege permissions
The default token permission set is broad enough that a compromised build step can push commits or publish a release. A read-only default costs one line and turns most injection findings into nothing.
Observable check
every workflow file sets a top-level permissions: block that grants no more than contents: read, and any job needing more declares the extra scope at the job level.
Where this comes from
- https://docs.github.com/en/actions/reference/secure-use-reference
- https://github.com/ossf/scorecard/blob/main/docs/checks.md
Last read against these sources on 2026-07-28.
GitHub recommends defaulting GITHUB_TOKEN to read access for contents. Scorecard Token-Permissions requires read-only at top level with write declared per job, which is exactly this rule's shape.