Give it four permissions
Open Permissions → Repository permissions. Set exactly these; leave every other row on No access. (Metadata: Read-only is added by GitHub automatically.)
| Where | Setting | Exact value | Why |
|---|---|---|---|
| Repository permissions | Actions | Read and write | Start the build and read its result |
| Repository permissions | Contents | Read and write | Put the app's code in the repository |
| Repository permissions | Workflows | Read and write | Add the build recipe file |
| Repository permissions | Secrets | Read and write | Give the build its read-only token for Fodide's own packages (it can read those packages and nothing else) |
| Repository permissions | Metadata | Read-only (automatic) | GitHub adds it with the four above |
| Account permissions | all | No access | Fodide never needs your account |