In this case the user only needs to setup [`permissions`](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs). One thing I'm not sure of is how to make it work with user/organization projects.