A read-only monitoring integration needs to list recent Actions runs for one repository through the REST API. Which token-permission approach follows least privilege?

1. Grant the appropriate repository Actions read permission to a token scoped to the intended repository.
2. Use actions: write only because read permissions never allow list endpoints.
3. Grant repository administration and organization owner permissions because all Actions APIs require them.
4. Embed a shared organization-wide administrator token in every monitored repository.