GitHub provides a feature to set permissions for the GITHUB_TOKEN. This App automatically calculates the right permissions for a given workflow.
These are the permissions that this App needs:
Developer
Step Security is provided by a third-party and is governed by separate terms of service, privacy policy, and support documentation.