| token | Token used for the API calls. Most sections need a fine-grained PAT with Administration read/write on the repository - the default GITHUB_TOKEN can never hold that permission. | no | ${{ github.token }} |
| repository | Target repository (owner/name). Defaults to the current repository. Single-repo mode only; cannot be combined with repos or repos-dir. | no | "" |
| settings-file | Path to the settings YAML file. Single-repo mode only; multi-repo targets read repos-dir files or each repository's own .github/settings.yml, so overriding it alongside repos or repos-dir fails the run. | no | .github/settings.yml |
| mode | apply (mutate) or check (report drift, exit 1 on any). check makes no settings changes, though a private report may still be delivered. | no | apply |
| on-missing-permission | fail (default) or warn. Under warn, sections the token cannot access are skipped with a warning and the run stays green (partial success). | no | fail |
| required-sections | Comma-separated section names that must fully apply even under on-missing-permission: warn (minimum requirements). | no | "" |
| sections | Optional comma-separated allowlist of sections to process. | no | "" |
| api-version | X-GitHub-Api-Version header value. Override to opt into a newer REST API version before this action defaults to it. | no | 2022-11-28 |
| repos | Multi-repo remote mode: comma- or newline-separated owner/name targets, each applied from its own .github/settings.yml (default branch), or "*" alone to discover every repository the token's user owns, filterable via the visibility, archived, forks, exclude, topics, and affiliation inputs. Combinable with repos-dir; a repos-dir file for the same repository wins. | no | "" |
| visibility | Keeps only repositories of this visibility in repos: "*" discovery. One of all (default), public, private, or internal; internal is matched client-side (Enterprise only). Fails if set without repos: "*". | no | "" |
| archived | Archived-repository policy for repos: "*" discovery. One of skip (default; settings writes fail on archived repositories), include, or only (mostly useful with mode: check). Fails if set without repos: "*". | no | "" |
| forks | Fork policy for repos: "*" discovery. One of include (default), exclude, or only. Fails if set without repos: "*". | no | "" |
| exclude | Comma- or newline-separated wildcard patterns removing repositories from repos: "*" discovery. "*" matches any characters; a pattern containing "/" matches the full owner/name, any other the name alone. Case-insensitive. Fails if set without repos: "*". | no | "" |
| topics | Comma- or newline-separated topics; repos: "*" discovery keeps only repositories carrying at least one of them. Unrelated to the topics settings section. Fails if set without repos: "*". | no | "" |
| affiliation | Comma-separated affiliations for repos: "*" discovery, passed to the GitHub /user/repos listing. Any of owner, collaborator, organization_member; the list replaces the default (owner), so use owner,collaborator to widen rather than move discovery. Fails if set without repos: "*". | no | "" |
| repos-dir | Multi-repo central mode: a directory in the checked-out admin repository holding per-repo settings files - <name>.yml (same owner as this repository) or <owner>/<name>.yml. Requires actions/checkout. | no | "" |
| defaults-file | YAML file deep-merged UNDER every multi-repo target's settings. Target keys win; objects merge, arrays and scalars replace; a target section set to null opts that repository out of the defaults section. Multi-repo mode only; fails when set without repos or repos-dir. | no | "" |
| private-repos | redact (default) or show. Under redact, private and internal targets are hidden from this run's public logs, summary, and outputs: their slug becomes a "private repository #N" placeholder, live values and error bodies are replaced with "hidden (private repository)", and each slug is registered with the runner's secret masker. A target equal to GITHUB_REPOSITORY is never redacted. show reveals everything (today's behavior); only use it when the run's logs are not publicly readable. | no | redact |
| private-report | none (default), issue, or artifact. Delivers the full unredacted report only for redacted targets the visibility probe proves private or internal (an unknown visibility is redacted but excluded from delivery). Under issue, each such target's report is delivered as a reused, marker-labelled issue on that target repository itself (the one GitHub-private channel a public run has): the body is replaced every run, and the issue is opened when the target fails or drifts and closed when it is healthy. Under artifact, those reports are concatenated, age-encrypted to report-public-key, and uploaded as one workflow artifact (settings-as-code-private-report) for readers who hold the key but no GitHub access to the targets; the artifact channel needs the Actions artifact service, so on GitHub Enterprise Server it warns and uploads nothing. Applies only to redacted targets, so it is rejected alongside private-repos: show. Report delivery writes even in mode: check, and its failure never changes the run's result. | no | none |
| report-public-key | The age recipient (an "age1..." public key) the artifact channel encrypts every report to; safe to commit in the workflow. Generate a keypair with "age-keygen -o key.txt", keep key.txt secret, and decrypt a downloaded artifact with "age -d -i key.txt private-report.md.age". Required when private-report is artifact and rejected otherwise. | no | "" |