Minimize token permissions

Before choosing a tool or writing more code, make the requirement concrete. Pull request tests receive read-only contents access, while one release job receives the specific write permission it needs.

Workflow credentials are capabilities; broad write permission turns an injection or compromised action into a larger incident. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to accept broad default permissions because the token is temporary. The happy path may still work, which makes the mistake easy to miss. declare restrictive top-level permissions and grant narrow job-specific writes only at the trusted boundary. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Reduce workflow authority and prevent untrusted repository input from becoming privileged code execution. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Set permissions to empty or read-only, observe failures, and add back only the documented capability. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.