To fix the problem, explicitly declare a permissions block that restricts the GITHUB_TOKEN to the minimal rights needed. This workflow only runs a shell echo and does not interact with the repository or GitHub APIs, so it can safely use fully restricted permissions (permissions: {}) or at least contents: read. Following GitHub’s recommendations, the safest choice here is to set permissions: {} at the job level so that this job’s token has no permissions.

Concretely, edit .github/workflows/attest.yml within the jobs.attest job to add a permissions: {} line between runs-on: ubuntu-latest and steps:. No new imports or external libraries are required; this is purely a YAML configuration change. Existing functionality is preserved because the job does not use the token at all.