Repository Contents API Token Scope Requirement is Misleading

[AdnaneKhan]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#create-or-update-file-contents

What part(s) of the article would you like to see updated?

The documentation for the repository contents API states that a token with the workflow scope is needed. This is misleading because a token with workflow scope is only needed if you are making changes to files within .github/workflows/. This could lead to end-users generating over-provisioned tokens when they do not need them. A workflow scoped PAT has repo write access and can trivially access all repo/org shared secrets.

It would be good if the documentation specified that workflow scope is only needed if the use case requires changes to workflow files. If not, then a repo scoped token is sufficient.

Additional information

No response

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[cmwilson21]

@AdnaneKhan Thanks so much for opening an issue! I'll triage this for the team to take a look 👀

[docs-bot]

Thank you for opening this issue! Updates to the REST API, GraphQL API, and webhook reference documentation must be made internally. I have copied your issue to an internal issue, so I will close this issue.