"Modifying the permissions for the GITHUB_TOKEN" should use a callout box for "When the permissions key is used, all unspecified permissions are set to no access"

[jsoref]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

What part(s) of the article would you like to see updated?

After:

You can use the permissions key in your workflow file to modify permissions for the GITHUB_TOKEN for an entire workflow or for individual jobs. This allows you to configure the minimum required permissions for a workflow or job.

Add a callout to the next bit:

Note

When the permissions key is used, all unspecified permissions are set to no access, with the exception of the metadata scope, which always gets read access.

Additional information

actions/deploy-pages#329 (comment)
actions/deploy-pages#329 (comment)
actions/deploy-pages#329 (comment)

[nguyenalex836]

@jsoref Thank you for raising this issue! I'll get this triaged for review ✨ Our team will provide feedback regarding the best next steps for this issue - thanks for your patience! 💛

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀

[nguyenalex836]

@jsoref Thank you for your patience while our SME team reviewed! They are in agreement regarding the addition of the new note you are proposing 💛

As there are already 2 note boxes in that section, we propose combining this note with the other note box:

Note

* Organization owners can prevent you from granting write access to the GITHUB_TOKEN at the repository level. For more information, see [Disabling or limiting GitHub Actions for your organization](https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization).

* <NEW NOTE GOES HERE>

Would you be willing to submit the PR for this update? We'll hold off on adding the help wanted label for now to give you a chance to submit the PR ✨