I’m trying to give workflow-scoped write-permissions to my GITHUB_TOKEN in order to authenticate a curl-request:

name: Deploy

on:
  release:
    types: [published]

permissions: write-all

jobs:
  release:
    runs-on: ubuntu-latest
    permissions: write-all

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      
      - name: Download artifacts informations 
        run: |
          curl -L 
            -H "Accept: application/vnd.github+json" 
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" 
            -H "X-GitHub-Api-Version: 2022-11-28" 
            https://api.github.com/repos/${{ github.repository_owner }}/${{ github.event.repository.name }}/actions/artifacts

However the curl output is:

{
  "message": "Resource not accessible by integration",
  "documentation_url": "https://docs.github.com/rest/actions/artifacts#list-artifacts-for-a-repository"
}

This is a typical output if permissions don’t suffice. I also checked the github action logs, specifically the step Set up job that is run before any custom steps are defined. It contains this section:

GITHUB_TOKEN Permissions
  Contents: read
  Metadata: read
  Packages: read 

which I figure should be write permissions. So the permissions attribute in the workflow file doesn’t seem to affect the permissions? I also tried it with job-scoped permissions, same issue.

The only way I can get it to work is to set the GITHUB token permissions on a repository bases (Settings>Actions>General>Workflow Permissions) to have “Read and write permissions”. If I do that the curl returns the expected listing. Also, the above GITHUB_TOKEN Permissions section expands to:

GITHUB_TOKEN Permissions
  Actions: write
  Attestations: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

Is this a bug or did I configure something wrong?