GitHub Actions Permissions
This short note documents important wrong default in GitHub Actions, which should be corrected for much better contribution experience.
Under there’s this setting (default pictured):

To save your contributors quite a bit of frustration, you want to flip it to this instead:

Obviously, the first best solution here is for GitHub itself to change the default.