Feature: differentiate between package and contents permission in Token-Permission

[laurentsimon]

We currently accepts package:write and contents:write if the workflow is a packaging workflow. We don't differentiate between a workflow that writes to a branch for the release (e.g. by pushing a binary for the tagged branch - needs contents) vs a workflow that pushes to a registry (need package).

[ristomcgehee]

To make sure I understand this issue:

What this would involve is breaking up isPackagingWorkflow into separate methods, one for pushing to a registry (such as gradle.*publish, docker/build-push-action) and one for publishing a release on GitHub (such as goreleaser/goreleaser-action, relekang/python-semantic-release). Then we'd only ignore a packages: write permission for jobs that push to a registry, and we'd only ignore a contents: write permission for jobs that release on GitHub. Am I describing this accurately?

[laurentsimon]

you're correct. I'm just not 100% sure whether some actions can do both or not.

[ristomcgehee]

I suppose I can always run the workflow in a test environment to see which permissions it needs. I'll structure the code in such a way that if an action does need both packages: write and contents: write, it won't have its points reduced.

I'll work on this issue.

[laurentsimon]

Awesome, thanks!

[ristomcgehee]

Completed in #1663.