Reader access
The audited GitHub Reader permission set includes Metadata, Contents, and Pull requests with read access. It is not accurately described as contents-only. Review the installation’s actual permission screen and repository selection before authorizing it.
Map and review
Confirm the workload maps to the intended repository, branch, and source file. Review the current requests and the proposed edit. A mapping alone does not prove the file is the deployment source of truth.
Execution is conditional
Draft pull-request creation must be enabled and authorized for the environment and account. It is not claimed as generally available here. Accepting a recommendation does not itself create a pull request, merge it, or deploy a workload.
If the workflow is unavailable
Check repository access, source mapping, branch and file availability, and the displayed reason. Have your evaluation contact confirm execution availability rather than assuming a permission error. Azure DevOps setup and exact provider steps remain pending current-source verification.
After a change
Your team reviews, merges, and deploys through its own process. A cluster verification reports what was observed at that time; it does not establish continuing drift monitoring.