marbre wrote: Without explicitly setting the token permission, the default (read/write for all scopes) kicks in, if not changed for the entire repo, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token. https://github.com/llvm/llvm-project/pull/87326