Limit the default GITHUB_TOKEN scope.
Section: Permissions and secrets
Set least-privilege token permissions
yaml
yaml
permissions:
contents: readExplanation
Restrict permissions at the workflow or job level unless write access is truly needed.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Permissions and secrets
Grant write access only where needed
Elevate token permissions on a specific job.
Expose a secret as an environment variable
Use the `secrets` context in step env.
Mask a dynamic sensitive value
Hide a generated or fetched secret from logs.
Use protected environments for deploys
Require approval and environment-scoped secrets.
Enable OIDC token issuance
Grant `id-token: write` when using cloud federation.
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.