Documentation / Reference / GitHub App Permissions
GitHub App Permissions
The minimal permissions WorkerRun requests to run your jobs.
| Permission | Level | Reason |
|---|---|---|
| Contents | Read | Read workflow YAML files |
| Checks | Write | Report job pass/fail status |
| Pull requests | Read | Access PR metadata, labels, reviewers |
Security note: WorkerRun never requests write access to your code or admin permissions. The permissions above are the complete set required for operation.
Workflow-level permissions: Individual workflow jobs can request additional permissions via the permissions: YAML key. These are reflected in the job's GITHUB_TOKEN and can further scope what the token is allowed to do. For example, a job that needs to publish packages can request packages: write in its permissions: block.