austenstone/GITHUB_TOKEN Permissions Audit
Statically find workflows that break when the default GITHUB_TOKEN permission is set to read-only.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | Token with repo + org/enterprise read access. | no | ${{ github.token }} |
| enterprise | Enterprise slug (audits all orgs). | no | — |
| org | Organization(s), whitespace/comma separated. | no | — |
| repo | Specific repo(s) owner/name, whitespace/comma separated. Defaults to the current repo. | no | — |
| include-archived | Include archived repos. | no | false |
| max-repos | Cap the number of repos scanned. | no | — |
| api-url | GitHub API base URL (for GHES). | no | — |
| fail-on | Fail the run on: none | breaks | review. | no | none |
Outputs
| name | description |
|---|---|
| breaks | Count of jobs that would break on a read-only default. |
| review | Count of jobs needing manual review. |
| safe | Count of read-only jobs with no permissions block. |
| explicit | Count of jobs with an explicit permissions block. |
| json | Full report as JSON. |