"Modifying the permissions for the GITHUB_TOKEN" should use a callout box for "When the permissions key is used, all unspecified permissions are set to no access"

[jsoref]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

What part(s) of the article would you like to see updated?

After:

You can use the permissions key in your workflow file to modify permissions for the GITHUB_TOKEN for an entire workflow or for individual jobs. This allows you to configure the minimum required permissions for a workflow or job.

Add a callout to the next bit:

Note

When the permissions key is used, all unspecified permissions are set to no access, with the exception of the metadata scope, which always gets read access.

Additional information

actions/deploy-pages#329 (comment)
actions/deploy-pages#329 (comment)
actions/deploy-pages#329 (comment)

[nguyenalex836]

@jsoref Thank you for raising this issue! I'll get this triaged for review ✨ Our team will provide feedback regarding the best next steps for this issue - thanks for your patience! 💛

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀