| app-id | GitHub App ID | yes | — |
| kms-key-id | AWS KMS key ID, key ARN, alias name, or alias ARN for RS256 JWT signing | yes | — |
| owner | The owner of the GitHub App installation (defaults to current repository owner) | no | — |
| repositories | Comma or newline-separated list of repositories (defaults to all repositories the app can access) | no | — |
| skip-token-revoke | If true, the token will not be revoked when the current job is complete | no | false |
| github-api-url | The URL of the GitHub REST API | — | ${{ github.api_url }} |
| permission-actions | Permission for GitHub Actions workflows. Can be set to 'read' or 'write'. | — | — |
| permission-administration | Permission for repository administration. Can be set to 'read' or 'write'. | — | — |
| permission-checks | Permission for checks on code. Can be set to 'read' or 'write'. | — | — |
| permission-contents | Permission for repository contents. Can be set to 'read' or 'write'. | — | — |
| permission-deployments | Permission for deployments. Can be set to 'read' or 'write'. | — | — |
| permission-environments | Permission for managing environments. Can be set to 'read' or 'write'. | — | — |
| permission-issues | Permission for issues. Can be set to 'read' or 'write'. | — | — |
| permission-members | Permission for organization members. Can be set to 'read' or 'write'. | — | — |
| permission-metadata | Permission for repository metadata. Can be set to 'read' or 'write'. | — | — |
| permission-packages | Permission for packages. Can be set to 'read' or 'write'. | — | — |
| permission-pages | Permission for Pages. Can be set to 'read' or 'write'. | — | — |
| permission-pull-requests | Permission for pull requests. Can be set to 'read' or 'write'. | — | — |
| permission-repository-hooks | Permission for repository webhooks. Can be set to 'read' or 'write'. | — | — |
| permission-secret-scanning-alerts | Permission for secret scanning alerts. Can be set to 'read' or 'write'. | — | — |
| permission-secrets | Permission for managing repository secrets. Can be set to 'read' or 'write'. | — | — |
| permission-security-events | Permission for security events. Can be set to 'read' or 'write'. | — | — |
| permission-statuses | Permission for commit statuses. Can be set to 'read' or 'write'. | — | — |
| permission-vulnerability-alerts | Permission for Dependabot alerts. Can be set to 'read' or 'write'. | — | — |
| permission-workflows | Permission for updating workflow files. Can be set to 'write'. | — | — |