permissioning-ci-workflows

wdm0006/python-skills

Give a CI job exactly the credentials it needs and know when it has none - explicit permissions blocks instead of the repo-wide default token scope, the 403 header that names the missing scope, one API call needing two scopes, fork pull requests running with a read-only token and no secrets, event-conditioned steps that skip on the re-run and go green, why pull_request_target is not the workaround, and preferring checks that need no credential

GitHub stars

108

Sponsors

SnugThe clipboard manager you and your agent can use, safelyAgent CaffeineClose your lid, come back to finished workWaxBlock anything with supervision, without erasing your iPhoneOpen StepsSponsoredFree and open-source skills that make AI coding agents easier to understand, verify, and control.