| github-token | GitHub token for API access (requires admin:org scope) | yes | — |
| github-api-url | GitHub API URL (e.g., https://api.github.com for GitHub.com or https://ghes.domain.com/api/v3 for GHES). Instance URL is auto-derived. | no | ${{ github.api_url }} |
| organizations | Comma-separated list of organization names | no | — |
| organizations-file | Path to YAML file containing organization settings configuration (orgs.yml) | no | — |
| custom-properties-file | Path to a YAML file defining custom property schemas to sync to target organizations | no | — |
| custom-property-values-file | Path to a YAML file defining custom property values to sync to target organization repositories | no | — |
| delete-unmanaged-properties | Delete custom properties not defined in the configuration file | no | false |
| issue-types-file | Path to a YAML file defining issue type definitions to sync to target organizations | no | — |
| delete-unmanaged-issue-types | Delete issue types not defined in the configuration file | no | false |
| issue-fields-file | Path to a YAML file defining issue field definitions to sync to target organizations | no | — |
| delete-unmanaged-issue-fields | Delete issue fields not defined in the configuration file | no | false |
| org-name | Organization display name | no | — |
| org-description | Organization description (max 160 chars) | no | — |
| org-company | Company name | no | — |
| org-location | Location | no | — |
| org-email | Publicly visible email | no | — |
| org-twitter-username | Twitter/X username | no | — |
| org-url | Website URL | no | — |
| org-blog | Blog/website URL (deprecated: use org-url) | no | — |
| default-repository-permission | Default permission level for org members on new repositories: read, write, admin, or none | no | — |
| members-can-create-repositories | Whether non-admin organization members can create repositories | no | — |
| members-can-create-public-repositories | Whether members can create public repositories | no | — |
| members-can-create-private-repositories | Whether members can create private repositories | no | — |
| members-can-create-internal-repositories | Whether members can create internal repositories (GHEC/GHES only) | no | — |
| members-can-fork-private-repositories | Whether members can fork private repositories | no | — |
| web-commit-signoff-required | Whether contributors must sign off on commits made through the web interface | no | — |
| members-can-create-pages | Whether members can create GitHub Pages sites | no | — |
| members-can-create-public-pages | Whether members can create public GitHub Pages sites | no | — |
| members-can-create-private-pages | Whether members can create private GitHub Pages sites | no | — |
| members-can-invite-outside-collaborators | Whether members can invite outside collaborators | no | — |
| members-can-create-teams | Whether members can create teams | no | — |
| members-can-delete-repositories | Whether members can delete repositories | no | — |
| members-can-change-repo-visibility | Whether members can change repository visibility | no | — |
| members-can-delete-issues | Whether members can delete issues | no | — |
| default-repository-branch | Default branch name for new repositories created in the organization | no | — |
| deploy-keys-enabled-for-repositories | Whether deploy keys can be added to repositories | no | — |
| readers-can-create-discussions | Whether users with read access can create discussions | no | — |
| members-can-view-dependency-insights | Whether members can view dependency insights | no | — |
| display-commenter-full-name-setting-enabled | Whether to display commenter full name in issues and PRs | no | — |
| organization-role-team-assignments-file | Path to a YAML file defining organization role team assignments to sync | no | — |
| custom-org-roles-file | Path to a YAML file defining custom organization role definitions to sync (requires GitHub Enterprise Cloud) | no | — |
| delete-unmanaged-org-roles | Delete custom organization roles not defined in the configuration file | no | false |
| custom-repo-roles-file | Path to a YAML file defining custom repository role definitions to sync (requires GitHub Enterprise Cloud) | no | — |
| delete-unmanaged-repo-roles | Delete custom repository roles not defined in the configuration file | no | false |
| dot-github-source-dir | Path to a local directory whose contents should be synced to the .github repository in each target organization (creates a PR with changes) | no | — |
| dot-github-private-source-dir | Path to a local directory whose contents should be synced to the .github-private repository in each target organization (creates a PR with changes) | no | — |
| create-missing-dot-github-repos | Whether to create missing .github / .github-private repositories before syncing (only applies to repos with a configured source-dir). Requires administration: write on the GitHub App at the org level. | no | false |
| dot-github-repo-visibility | Visibility to use when creating the .github repository: public, private, or internal. EMU and restricted-GHEC orgs should set this to internal. | no | public |
| dot-github-private-repo-visibility | Visibility to use when creating the .github-private repository: public, private, or internal. | no | private |
| rulesets-file | Comma-separated paths to JSON files, each containing a single organization ruleset configuration to sync | no | — |
| delete-unmanaged-rulesets | Delete all other rulesets besides those being synced | no | false |
| code-security-configurations-file | Path to a YAML file defining code security configurations to sync to target organizations | no | — |
| delete-unmanaged-code-security-configurations | Delete code security configurations not defined in the configuration file | no | false |
| actions-policy-allowed-actions | Allowed GitHub Actions policy: all, local_only, or selected | no | — |
| actions-policy-github-owned-allowed | Whether GitHub-owned actions are allowed (only when allowed-actions is selected) | no | — |
| actions-policy-verified-allowed | Whether actions from GitHub Marketplace verified creators are allowed (only when allowed-actions is selected) | no | — |
| actions-allow-list-file | Path to a YAML file defining allowed actions/reusable workflow patterns (only when allowed-actions is selected) | no | — |
| actions-policy-default-workflow-permissions | Default GITHUB_TOKEN permissions for workflows: read or write | no | — |
| actions-policy-actions-can-approve-pull-request-reviews | Whether GitHub Actions can approve pull request reviews | no | — |
| dry-run | Preview changes without applying them (logs what would be changed) | no | false |