| Actions | Read and write | When prompted, generate and validate code quality fixes |
| Checks | Read and write | Post code quality information on pull requests |
| Code scanning alerts | Read and write | Generate unified code quality reports including security issues |
| Commit statuses | Read and write | Post code quality information on pull requests |
| Contents | Read and write | When prompted, push branches to open pull requests |
| Custom properties | Read-only | Simplify administration by leveraging custom repository metadata |
| Deployments | Read and write | Track the quality of and optionally gate deploys |
| Environments | Read-only | Track the quality of and optionally gate deploys |
| Issues | Read and write | When prompted, create issues for code quality issues |
| Metadata | Read-only | Mandatory by GitHub |
| Packages | Read-only | When needed, install private packages to run static analysis |
| Pull Requests | Read and write | When prompted, open PRs to update config or improve code quality |
| Workflows | Read and write | When prompted, open PRs that change GitHub Actions workflows, such as automatic coverage setup |
