From 8fe33f6696179d1fe16aea6640f55acf5a85b0e6 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Tue, 25 Aug 2026 11:33:57 +0200 Subject: [PATCH] docs: document GitHub workflow permissions --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index b70f9e6..a5f0dcf 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,9 @@ on: pull_request: jobs: github: + permissions: + contents: read + issues: read uses: rubykatzen/baseline/.github/workflows/github-shared.yml@v0.16.2 ``` @@ -63,6 +66,9 @@ Baseline checks the repository settings and labels against automatic branch deletion, auto-merge, and the canonical label set and colors. Release Please labels are allowed but optional. +The caller grants both permissions because a reusable workflow can reduce its +caller's `GITHUB_TOKEN` permissions, but cannot elevate them. + ## Check shared repository files Create `.github/workflows/embedder.yml`: