World map

 

BM

World C4: Pipeline Shields

Least-privilege permissions

You will learn: how to give each job only the keys it needs with permissions.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Your release job turns red with this error:

HTTP 403: Resource not accessible by integration

What does it mean?

Watch

Each job gets a key card: the GITHUB_TOKEN: A short-lived key each job gets. It stops working when the job ends.. permissions: picks its doors. Open only what the job needs. That is least privilege: Give each worker only the keys their station needs. Nothing extra..

Drag a card into a box. Or tap the card, then tap the box.

        Watch

        permissions: {} at the top gives no keys. Then each job asks for its own. List some keys, and every other key becomes none.

        Tap the line that lets a job create a release.

        0 of 1 found

        Try it

        Push tag v1.4.0. The release step is refused. Pick the smallest fix that turns it green.

        The line is red. Fix the yellow lines, then run again.

        What happened on GitHub

        Workflow file .github/workflows/release.yml

        name: Release
on:
push:
tags: ['v*']
permissions:
contents: read
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: npm ci
- run: npm test
- run: gh release create "$GITHUB_REF_NAME" --generate-notes
env:
GH_TOKEN: ${{ github.token }}

        Yellow: lines 5–6. You can change these.

        Pick a fix

        The line

        Push tag v1.4.0 · v1.4.0

        Predict

        Your PR job has pull-requests: write. A stranger opens a PR from a fork. It runs on pull_request. Can it comment?

        Try it

        Build it. The file reads code only. The job adds one door: PR comments. Job keys replace the file’s keys, so list both.

        Tap blocks to add them. Put them in order.

        Blocks

        Your workflow

        Tap a block above to start.

        Workflow file .github/workflows/

        name: PR report

        What runs

        Nothing to run yet.

        You did it!

        You can now give each job only the keys it needs.

        Go deeper (optional)

        Repo settings also pick a default key: read-only, or read and write. Don’t trust the default. Write permissions: in every workflow. Tip: split a release into a test job and a release job. Only the release job gets contents: write. Real rep: add permissions: with contents: read to one of your workflows.