Permissioning CI Workflows

A job that only reads code and runs tests needs no thought about credentials. The moment a step comments on a pull request, pushes a commit, opens an issue, uploads a report, or calls another repository's API, it depends on two things that are invisible in the YAML: which scopes the token carries, and whether the run was allowed to have secrets at all.

Both fail in the same shape — every build, lint, and test step green, one trailing step red — which is why they get re-run instead of fixed.

For the cost side of workflows (triggers, concurrency, caching, matrix), see running-github-actions-efficiently. This skill is about what a workflow is allowed to do.

Declare permissions; never inherit them