# POLICY-ENGINE TARGET. This workflow parses cleanly and is schema-valid; what it fails is
# least-privilege review. `permissions: write-all` grants every scope to GITHUB_TOKEN, and the
# job-level block re-grants writes the job never uses. A policy engine should flag both.
name: Over-permissive token

on:
  pull_request:

permissions: write-all

jobs:
  label:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - run: echo "this job only reads contents"