A repository owner wants to let Copilot and automation help with deployment preparation without allowing agent-generated changes to deploy production code without human approval. The design must keep build permissions narrow, protect production secrets, and require review before deployment. Which four actions should you perform in order? 1. Configure the production environment with required reviewers 2. Grant contents: write to every job for consistency 3. Set workflow-level permissions to contents: read by default 4. Reference the production environment only in the deploy job 5. Run deployment immediately after Copilot opens a draft PR 6. Grant deployment-specific permissions only in the deploy job

The correct order ensures secure and controlled deployment. 1. Set workflow-level permissions to contents: read by default (3): This establishes a secure baseline, preventing unintended write access across the entire workflow and adhering to the principle of least privilege. 2. Configure the production environment with required reviewers (1): This directly addresses the requirement for human approval before deployment, integrating a mandatory review step into the production environment. 3. Reference the production environment only in the deploy job (4): This isolates access to the sensitive production environment, ensuring that only the specific deployment job can interact with it, further enhancing security. 4. Grant deployment-specific permissions only in the deploy job (6): This provides the necessary permissions (like id-token: write for OIDC or secrets: inherit) precisely where they are needed for deployment, without over-privileging other jobs. Incorrect options fail to meet security requirements. For example, granting contents: write to every job (2) is overly permissive and insecure. Running deployment immediately after a draft PR (5) bypasses human review, violating a core requirement.