workflow

Why Tier 1

Tier 1 because it reaches Workflows: Write (repository).

Without it, a classic token cannot push changes under .github/workflows. With it, the holder can change what workflows run and reach their secrets.

GitHub: Grants the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose `GITHUB_TOKEN` which may have a different set of scopes. For more information, see Use GITHUB_TOKEN for authentication in workflows.