In general, this problem is fixed by explicitly defining a permissions: block for the workflow or for individual jobs, granting only the minimal scopes required. For a job that only reads context information (like github.head_ref) and doesn’t interact with repository contents, PRs, or issues, the least‑privilege configuration is to set contents: read at the workflow or job level (or even permissions: {} if no GitHub API access is needed, but contents: read is a common safe baseline).

For this specific file, the simplest non‑breaking fix is to add a root‑level permissions: block that applies to all jobs. The workflow only reads metadata and performs shell logic, so we can restrict the token to read‑only repository contents. Concretely, in .github/workflows/validate-branch-into-main.yaml, insert:

permissions:
  contents: read

between the name: section and the on: block (e.g., after line 2), leaving all job and step definitions unchanged. No imports or additional methods are needed since this is just a YAML configuration change and does not affect the workflow’s behavior.