{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-actions-token-context-job-permissions/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
        "slug": "github-actions-token-context-job-permissions",
        "url": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-actions-token-context-job-permissions/"
        },
        "title": "Limit GITHUB_TOKEN permissions even when an action is not explicitly passed the token",
        "summary": "Omitting a token input does not prove an action lacks access to the workflow’s token context.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:20+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 283,
        "potentially_affected": "This concerns the built-in workflow token. Personal access tokens, GitHub App tokens, environment secrets and external credentials have separate permission and lifecycle decisions.",
        "dse_recommendation": "DSE recommends listing each job’s required GitHub operations before assigning token permissions.",
        "primary_source": {
            "name": "GitHub — Use GITHUB_TOKEN for authentication in workflows",
            "url": "https://docs.github.com/en/actions/tutorials/authenticate-with-github_token",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Omitting a token input does not prove an action lacks access to the workflow’s token context.</p>\n<h2>Source facts</h2>\n<p>GitHub states that an action can access GITHUB_TOKEN through the github.token context even when a workflow does not explicitly pass it as an input. The permissions key can limit token permissions for the entire workflow or individual jobs. GitHub recommends granting only the access required. Its examples assign specific capabilities to the job that needs them.</p>\n<p>Source: <a href=\"https://docs.github.com/en/actions/tutorials/authenticate-with-github_token\">GitHub — Use GITHUB_TOKEN for authentication in workflows</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns the built-in workflow token. Personal access tokens, GitHub App tokens, environment secrets and external credentials have separate permission and lifecycle decisions.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends listing each job’s required GitHub operations before assigning token permissions. Give an ordinary build a different permission set from a job that writes issues, packages or repository contents. Review every third-party action against the effective token capabilities, including implicit context access. Keep a documented reason for every write permission and review it when a workflow gains a new step or starts processing untrusted input. Include implicit context access in the workflow review checklist. Ask the job owner to justify each write capability against a specific required operation, and repeat that review when a third-party action or an untrusted-input path is added to the job.</p>\n<h2>Verification</h2>\n<p>Proposed verification: use a harmless test workflow to exercise an intended operation and an operation outside the approved permission set. Inspect the effective job configuration and resulting responses. Retain permission names and outcomes without exposing the token. Confirm a denied action is explained before increasing privileges to make the workflow pass.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/actions/tutorials/authenticate-with-github_token\">GitHub — Use GITHUB_TOKEN for authentication in workflows</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Omitting a token input does not prove an action lacks access to the workflow’s token context.\nSource facts\nGitHub states that an action can access GITHUB_TOKEN through the github.token context even when a workflow does not explicitly pass it as an input. The permissions key can limit token permissions for the entire workflow or individual jobs. GitHub recommends granting only the access required. Its examples assign specific capabilities to the job that needs them.\nSource: GitHub — Use GITHUB_TOKEN for authentication in workflows.\nApplicability\nThis concerns the built-in workflow token. Personal access tokens, GitHub App tokens, environment secrets and external credentials have separate permission and lifecycle decisions.\nDSE recommendation\nDSE recommends listing each job’s required GitHub operations before assigning token permissions. Give an ordinary build a different permission set from a job that writes issues, packages or repository contents. Review every third-party action against the effective token capabilities, including implicit context access. Keep a documented reason for every write permission and review it when a workflow gains a new step or starts processing untrusted input. Include implicit context access in the workflow review checklist. Ask the job owner to justify each write capability against a specific required operation, and repeat that review when a third-party action or an untrusted-input path is added to the job.\nVerification\nProposed verification: use a harmless test workflow to exercise an intended operation and an operation outside the approved permission set. Inspect the effective job configuration and resulting responses. Retain permission names and outcomes without exposing the token. Confirm a denied action is explained before increasing privileges to make the workflow pass.\nOfficial reference\nGitHub — Use GITHUB_TOKEN for authentication in workflows. Reviewed October 20, 2026.",
        "content_markdown": "Omitting a token input does not prove an action lacks access to the workflow’s token context.\n\n## Source facts\n\nGitHub states that an action can access GITHUB_TOKEN through the github.token context even when a workflow does not explicitly pass it as an input. The permissions key can limit token permissions for the entire workflow or individual jobs. GitHub recommends granting only the access required. Its examples assign specific capabilities to the job that needs them.\n\nSource: [GitHub — Use GITHUB_TOKEN for authentication in workflows](https://docs.github.com/en/actions/tutorials/authenticate-with-github_token).\n\n## Applicability\n\nThis concerns the built-in workflow token. Personal access tokens, GitHub App tokens, environment secrets and external credentials have separate permission and lifecycle decisions.\n\n## DSE recommendation\n\nDSE recommends listing each job’s required GitHub operations before assigning token permissions. Give an ordinary build a different permission set from a job that writes issues, packages or repository contents. Review every third-party action against the effective token capabilities, including implicit context access. Keep a documented reason for every write permission and review it when a workflow gains a new step or starts processing untrusted input. Include implicit context access in the workflow review checklist. Ask the job owner to justify each write capability against a specific required operation, and repeat that review when a third-party action or an untrusted-input path is added to the job.\n\n## Verification\n\nProposed verification: use a harmless test workflow to exercise an intended operation and an operation outside the approved permission set. Inspect the effective job configuration and resulting responses. Retain permission names and outcomes without exposing the token. Confirm a denied action is explained before increasing privileges to make the workflow pass.\n\n## Official reference\n\n[GitHub — Use GITHUB_TOKEN for authentication in workflows](https://docs.github.com/en/actions/tutorials/authenticate-with-github_token). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
                "url": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Limit GITHUB_TOKEN permissions even when an action is not explicitly passed the token",
                        "item": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
                "url": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/",
                "headline": "Limit GITHUB_TOKEN permissions even when an action is not explicitly passed the token",
                "description": "Omitting a token input does not prove an action lacks access to the workflow’s token context.",
                "abstract": "Omitting a token input does not prove an action lacks access to the workflow’s token context.",
                "articleBody": "Omitting a token input does not prove an action lacks access to the workflow’s token context.\nSource facts\nGitHub states that an action can access GITHUB_TOKEN through the github.token context even when a workflow does not explicitly pass it as an input. The permissions key can limit token permissions for the entire workflow or individual jobs. GitHub recommends granting only the access required. Its examples assign specific capabilities to the job that needs them.\nSource: GitHub — Use GITHUB_TOKEN for authentication in workflows.\nApplicability\nThis concerns the built-in workflow token. Personal access tokens, GitHub App tokens, environment secrets and external credentials have separate permission and lifecycle decisions.\nDSE recommendation\nDSE recommends listing each job’s required GitHub operations before assigning token permissions. Give an ordinary build a different permission set from a job that writes issues, packages or repository contents. Review every third-party action against the effective token capabilities, including implicit context access. Keep a documented reason for every write permission and review it when a workflow gains a new step or starts processing untrusted input. Include implicit context access in the workflow review checklist. Ask the job owner to justify each write capability against a specific required operation, and repeat that review when a third-party action or an untrusted-input path is added to the job.\nVerification\nProposed verification: use a harmless test workflow to exercise an intended operation and an operation outside the approved permission set. Inspect the effective job configuration and resulting responses. Retain permission names and outcomes without exposing the token. Confirm a denied action is explained before increasing privileges to make the workflow pass.\nOfficial reference\nGitHub — Use GITHUB_TOKEN for authentication in workflows. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:20+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-actions-token-context-job-permissions/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Limit GITHUB_TOKEN permissions even when an action is not explicitly passed the token"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 283,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — Use GITHUB_TOKEN for authentication in workflows",
                    "url": "https://docs.github.com/en/actions/tutorials/authenticate-with-github_token"
                }
            }
        ]
    }
}