| execution_mode | Execution mode (install_or_upgrade_ansible, run_playbook, run_ad_hoc_command) | no | run_playbook |
| working_directory | Working directory inside automation repo | no | . |
| ansible_version | Ansible package version selector (latest or explicit version) | no | latest |
| ansible_install_type | Ansible package to install (core or full) | no | core |
| python_version | Python version used by setup-python | no | 3.11 |
| automation_repo | Owner/repo containing Ansible roles and playbooks (defaults to current workflow repository when omitted) | no | "" |
| automation_ref | Git ref for automation repo (defaults to current workflow ref when omitted) | no | "" |
| automation_token | Token for automation repo checkout; when automation_repo defaults to current workflow repository, pass an explicit token (for example secrets.GITHUB_TOKEN) | no | — |
| inventory_repo | Owner/repo containing inventory and environment vars (defaults to current workflow repository when omitted) | no | "" |
| inventory_ref | Git ref for inventory repo (defaults to current workflow ref when omitted) | no | "" |
| inventory_token | Token for inventory repo checkout; when inventory_repo defaults to current workflow repository, pass an explicit token (for example secrets.GITHUB_TOKEN) | no | — |
| playbook_path | Playbook path inside automation repo (required for execution_mode=run_playbook) | no | — |
| inventory_path | Inventory path inside inventory repo (required for run_playbook and run_ad_hoc_command) | no | — |
| host_pattern | Host targeting pattern (`-l` for playbook mode; positional host pattern for ad-hoc mode) | no | — |
| ad_hoc_module | Ansible ad-hoc module name for command mode (default shell) | no | — |
| ad_hoc_module_args | Module arguments for ad-hoc command mode (for example uname -a) | no | — |
| check_mode | Run ansible in check mode | no | false |
| enforce_check_mode_on_pr | Fail PR run if check_mode is false | no | true |
| tags | Comma-separated ansible tags | no | — |
| skip_tags | Comma-separated ansible skip-tags | no | — |
| verbosity | Verbosity level 0..4 | no | 0 |
| extra_vars | Extra vars YAML/JSON or key=value list | no | — |
| extra_vars_file | Extra vars file path in inventory repo | no | — |
| diff_mode | Run ansible with --diff | no | false |
| become | Run tasks with privilege escalation (--become) | no | false |
| become_user | User to become with --become-user | no | — |
| forks | Number of parallel forks (--forks) | no | 5 |
| timeout | SSH timeout in seconds (--timeout) | no | 10 |
| start_at_task | Start execution at specific task name (--start-at-task) | no | — |
| ansible_config_path | Optional ANSIBLE_CONFIG path for runtime | no | — |
| vault_password_secret_env | Env var name that contains ansible vault password | no | — |
| github_token | Optional generic token; defaults to GITHUB_TOKEN | no | — |
| ca_bundle_path | Optional CA bundle path for enterprise TLS | no | — |
| artifact_name | Name for uploaded action artifacts | no | ansible-run-artifacts |