New permissions consent?

[baywet]

Hi Team,
My Gitlens VSCode auto-updated today, and it's asking me to consent to new permissions on GitHub.
There are a couple of permissions I find concerning from a security perspective:

• public SSH key, admin
• repos webhooks, admin
• workflows, edit

If a token with those permissions gets compromised somehow, it could be used to craft new commits, edit the CI configuration, and setup some hidden automations on any repository I have access to. That in turns could be used to compromise packages I'm working on, and we've seen quite a few of those types of attacks over the last couple years.

I'm really questioning why does the extension need such permissions, when it's essentially "rendering the git log in a nice way" (or at least that's all I'm using it for) ???

Thanks for the information here.