Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Use permissions-none as default (when owner is set)

Open
#330 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, javascript
Domain
authorization, security

Research direction

Start by tracing how the action chooses token permissions when an owner is set and no explicit permissions are provided. Check the existing action entry point and tests, if present, to understand the current default and verify that permissions-none is used only for this case. Done means the default no longer grants the app's full permissions and existing explicit-permission behavior remains unchanged.

Written by the indexing model from the issue text.

Description

stale

Currently, the token has the full permission of the app. IMHO you should explicitly opt-in what permissions the new token should have.

Dominant language
JavaScript
Stars
886
Forks
174
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from actions/create-github-app-token

All issues in actions/create-github-app-token

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.