diff --git a/.fabro/workflows/gh-list/workflow.fabro b/.fabro/workflows/gh-list/workflow.fabro
new file mode 100644
index 000000000..176e6bfe3
--- /dev/null
+++ b/.fabro/workflows/gh-list/workflow.fabro
@@ -0,0 +1,12 @@
+digraph GhList {
+    graph [goal="List open PRs and issues via the gh CLI to verify GITHUB_TOKEN injection"]
+    rankdir=LR
+
+    start [shape=Mdiamond, label="Start"]
+    exit  [shape=Msquare, label="Exit"]
+
+    list_prs    [label="List PRs",    shape=parallelogram, script="gh pr list --state open --limit 50 2>&1"]
+    list_issues [label="List Issues", shape=parallelogram, script="gh issue list --state open --limit 50 2>&1"]
+
+    start -> list_prs -> list_issues -> exit
+}
diff --git a/.fabro/workflows/gh-list/workflow.toml b/.fabro/workflows/gh-list/workflow.toml
new file mode 100644
index 000000000..df42f2eea
--- /dev/null
+++ b/.fabro/workflows/gh-list/workflow.toml
@@ -0,0 +1,5 @@
+_version = 1
+
+[run.integrations.github.permissions]
+pull_requests = "read"
+issues = "read"