Permissions needed

[Almenon]

I was about to install MEEP and then I realized it would give MEEP write access to my repo, among other things 😬

This is not MEEP's fault - it appears to be included in the list of permissions granted with the permissions granted to GITHUB_TOKEN:

https://docs.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token

Do you know any way around this? Ideally I'd like to install MEEP as securely as possible, only with the permissions it strictly needs.

[jeremyong]

Hmm so the auth token is needed to "hydrate" the github actions toolkit to perform REST requests. Meep doesn't actually write or read anything. It should be possible to write it to perform anonymous requests but these are subject to a rate limit so I'm not sure if that will be an issue.