permissionizer/Permissionizer: Request Token

An action to request short-lived, policy-based tokens from the Permissionizer App as a secure alternative to PATs.

Trust Signals

workflow.ymlSHA-pinned

uses: permissionizer/request-token@4d6cbc13f8db9a5ade754e6e3c991b536441676a # v1.1.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
target-repository	The target repositories to request the token for. Accepts a comma-separated list, multi-line value or JSON array of repository names in the format owner/repo.	yes	—
permissions	The permissions with access level to request for the token, ALL permissions must be allowed by the explicit policy on the target repository. Accepts a comma-separated list, multi-line value or JSON object.	yes	—
revoke-token	Whether to revoke the token after the job completes. Defaults to `true`. This ensures that the token is short-lived and cannot be misused later.	no	true
permissionizer-server	The URL of the Permissionizer server to use. Defaults to the official Permissionizer server - https://permissionizer.app.	no	https://permissionizer.app

name	description
token	A short-lived token issued by the Permissionizer App after validating the explicit policy on the target repository.
issued-by	A repository that requested the token.
expires-at	Time when the token expires.
repositories	A list of repositories that the token is valid for, all target repositories must define the explicit policy allowing the requested permissions.
permissions	A list of permissions granted by the issued token.