GitHub
Security & compliance
Releases
Workflow missing permissions block
Part of the Actions supply chain check · fix arrives as a pull request
What it is
A workflow declares no permissions block, so its GITHUB_TOKEN gets whatever the repository or organisation default grants — often write across scopes.
Why it matters
Every action in the job inherits that token. A compromised or over-curious dependency can push commits, edit releases, or open pull requests, and nothing in the workflow needed those rights to begin with.
How to fix it
Set permissions: contents: read at the workflow level and grant additional scopes per job only where required. Setting the organisation default to read-only makes this the baseline everywhere.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.