Read access is sufficient to retrieve workflow artifacts from a repository. GitHub ' s Actions artifact API documentation states that anyone with read access to the repository can retrieve an artifact. For private repositories, authentication is still required, and token-based access must provide the necessary repository or Actions read permission, but the user ' s repository role does not need to be Write, Maintain, or Admin. Those higher roles grant additional repository-management capabilities that are unnecessary for simply downloading artifacts. Triage also provides more issue and pull-request management capabilities than basic Read, but it is not the minimum required repository role for artifact access. Therefore, following the principle of least privilege, Read is the lowest permission among the listed choices that supports downloading GitHub Actions workflow artifacts.
================
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit