Skip to content
Sarj Repo Standards
sarj/github/explicit-permissions

Declare Actions permissions

GitHub workflows declare token permissions explicitly.

warning beta

Examples

FlaggedFails
jobs:
  test:
    timeout-minutes: 15
    steps:
      - run: echo ok
PassesClean
permissions:
  contents: read
jobs:
  test:
    timeout-minutes: 15
    steps:
      - run: echo ok

Why it matters

Jobs inherit repository defaults that may grant more token access than intended.

How detection works

A workflow has neither top-level permissions nor explicit permissions on every job.

What is inspected

  • parsed workflow and job permission declarations

Limits

  • proving every declared permission is semantically minimal

How to fix it

Declare permissions at workflow or job scope.

  1. Add top-level permissions or declare permissions on every job.

Verify

  • Run repo-lint again and confirm the rule passes.