GitHub Actions Permissions
- Prefer workflow-level
contents: readandpull-requests: read. - Add narrower job permissions only when needed.
- Secret scanning must not require write permissions.
- Never use
pull_request_targetwithout explicit threat modeling.