Document permissions grants

diff --git a/.github/workflows/spelling3.yml b/.github/workflows/spelling3.yml
index 7a8f41339012706c2db8dd2985ca119360838881..5888f89a12cd08da1726d8cc4b21054e913ff25e 100644 (file)
--- a/.github/workflows/spelling3.yml
+++ b/.github/workflows/spelling3.yml
@@ -22,8 +22,14 @@ jobs:
   spelling:
     name: Spell checking
     permissions:
+      # contents-read is needed to checkout in private repositories
       contents: read
+      # actions-read is needed (possibly only for private repositories)
+      # to identify the workflow's filename until
+      # https://github.com/actions/runner/issues/853 is fixed
       actions: read
+      # security-events-write is needed according to the documentation:
+      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions
       security-events: write
     outputs:
       followup: ${{ steps.spelling.outputs.followup }}