Unsure of solution for fixing "contents: write" security recommendation

[drewroengoogle]

Is your feature request related to a problem? Please describe.
Hello! We are seeing the scorecard recommendation in the image under "Additional context". You can find the line we are getting the recommendation for here. The scorecard recommendation ID is TokenPermissionsID.

Describe the solution you'd like
The remediation for this scorecard recommendation currently tells us to set permissions to read-all, although we already have permissions set to read-all in this file. I believe we have implemented the solution that is being recommended, so it seems like the remediation might be misleading, unless I'm mistaken. Is there an additional change that should be made in this configuration?

Additional context

[godofredoc]

I believe this is because contents: write grants write access to multiple APIs. https://docs.github.com/en/github-ae@latest/rest/overview/permissions-required-for-github-apps#permission-on-contents

What is the recommended best practice in this case? find a more limited permission?

[laurentsimon]

do you need these permissions to write to the GitHub pages using peaceiris/actions-gh-pages?

Which API is it using? I think it may be worth asking GitHub for a more granular permission for this, because pushing docs is less scary than pushing to source code. Well, docs can trick users into running arbitrary commands.. but it's not very stealthy if this is the public doc.

In this case you probably have no way around it and I would dismiss the alert. What we could do it tweak the messaging and say "if you need to write to GH pages, you can dismiss the alert"...?

/cc @olivekl any thoughts to make the messaging more general without encouraging users to dismiss all alerts?

[drewroengoogle]

To answer your first question: yes, contents: write is currently being used for peaceiris/actions-gh-pages

[laurentsimon]

peaceiris/actions-gh-pages seems to be a widely used Action to do that. Since GitHub does not have a special permission for documentation push, I'm inclined to make the permission check aware of this action and not warn if it's used in the workflow that requires the write permission. We do this for other standard action like Goreleaser, for example.