Controlling required permissions in maintenance workflow

[reggie-k]

The gh aw compile auto-generated .github/workflows/agentics-maintenance.yml contains write permissions for PRs, discussions and issues.
In our case, we just want to use the issue triage workflow, so we don't want to give write permissions for PRs and discussions. I understand that the write permissions for issues are needed if the agent raises an issue about a workflow failure and then deletes the issue after some expiry time.

I understand that the agentics-maintenance.yml is a generic workflow, that is run for all types of agentic workflows and not specific to any workflow type?

Given we only want to use issue triage workflow and our interaction is only with the issue-triage.md file, how can we limit the maintenance workflow permissions entirely to read only or at least to only issue write permissions?

[reggie-k]

There are more permissions that are not needed for issue triage:
actions: write
contents: write

[pelikhan]

@copilot add syntax in agentic maintenance to disable the generation of specific job. Review each job and minimize required permissions.