Guidance on permissions for fine-grained tokens

[madchap]

Hi,

It would be great to have guidance on which permissions are needed when using fine-grained tokens. Thanks!

[eilidhmae]

Second this. I am blocked, and find this step too vague to proceed.

[backspace]

yes, did something change about permissions for tokens? I remember it being a checklist with code-like names as described in the documentation (org:read) but in the Github UI they’re all English-y names now

[backspace]

Following up, I found that these permissions are what worked:

I didn’t iterate this one step at a time because I needed someone to approve permissions changes for me, but this is probably the minimal set, or close to it, for our structure, at least.

[KevinWu098]

Implemented PAT on an org recently. Based on this comment in a similar thread, I was able to get it working. My settings being:

Actions: Read/Write
Contents: Read/Write
Metadata: Read (required)

Happy to put up a PR to add this guidance to the docs, lmk @peter-evans