You want to favourite this post:
How do you apply the principle of least privilege when you're integrating external systems with GitHub Actions? Check out some tips!
https://github.blog/2021-04-13-implementing-least-privilege-for-secrets-in-github-actions/
