include-source: false # Drop file/line/col from output skip: - Go permissions-policy: LimitedRead --- on: push permissions: write-all jobs: build: uses: contoso/templates/.github/workflows/build.yml@v1 --- contoso/templates/.github/workflows/build.yml@v1 --- on: workflow_call permissions: actions: read jobs: # Inherits workflow level deploy: runs-on: ubuntu-latest steps: - run: echo 1 # Overrides workflow level deploy2: permissions: actions: write runs-on: ubuntu-latest steps: - run: echo 1 --- { "permissions": { "actions": "write", "checks": "write", "contents": "write", "deployments": "write", "discussions": "write", "id-token": "write", "issues": "write", "packages": "write", "pages": "write", "pull-requests": "write", "repository-projects": "write", "security-events": "write", "statuses": "write" }, "jobs": [ { "type": "reusableWorkflowJob", "id": "build", "name": "build", "needs": [], "if": { "type": 3, "expr": "success()" }, "ref": "contoso/templates/.github/workflows/build.yml@v1", "permissions": { "actions": "read" }, "jobs": [ { "type": "job", "id": "deploy", "name": "deploy", "if": { "type": 3, "expr": "success()" }, "permissions": { "actions": "read" }, "runs-on": "ubuntu-latest", "steps": [ { "id": "__run", "if": { "type": 3, "expr": "success()" }, "run": "echo 1" } ] }, { "type": "job", "id": "deploy2", "name": "deploy2", "if": { "type": 3, "expr": "success()" }, "permissions": { "actions": "write" }, "runs-on": "ubuntu-latest", "steps": [ { "id": "__run", "if": { "type": 3, "expr": "success()" }, "run": "echo 1" } ] } ] } ] }