What problem would this solve?
#36173 added settings for the Actions job token: the permission mode, the maximum permissions, and which repositories a job may read across the same owner. Thanks for that, it's exactly what I needed.
These settings can only be changed in the web UI. There is no API to read or set them (checked on 1.27.3 and main).
I manage my instance as code: a script reconciles users, teams, collaborators and tag protections through the API, and re-applies them after a rebuild. The token settings are the one part it can't cover. In practice, instead of letting one repository's jobs read another private repository's releases through cross-repository access, I created a separate read-only account and token, only because an account can be managed through the API.
What do you propose?
Endpoints to read and update these settings, with the same permissions as the settings pages (org owner / repo admin). For example:
GET/PUT /api/v1/orgs/{org}/actions/permissions: permission mode, maximum permissions, cross-repository access listGET/PUT /api/v1/repos/{owner}/{repo}/actions/permissions: the repository-level settings, including whether to follow the owner
GitHub has comparable endpoints:
Drafted with AI assistance; reviewed and edited by me.
What problem would this solve?
#36173 added settings for the Actions job token: the permission mode, the maximum permissions, and which repositories a job may read across the same owner. Thanks for that, it's exactly what I needed.
These settings can only be changed in the web UI. There is no API to read or set them (checked on 1.27.3 and main).
I manage my instance as code: a script reconciles users, teams, collaborators and tag protections through the API, and re-applies them after a rebuild. The token settings are the one part it can't cover. In practice, instead of letting one repository's jobs read another private repository's releases through cross-repository access, I created a separate read-only account and token, only because an account can be managed through the API.
What do you propose?
Endpoints to read and update these settings, with the same permissions as the settings pages (org owner / repo admin). For example:
GET/PUT /api/v1/orgs/{org}/actions/permissions: permission mode, maximum permissions, cross-repository access listGET/PUT /api/v1/repos/{owner}/{repo}/actions/permissions: the repository-level settings, including whether to follow the ownerGitHub has comparable endpoints:
Drafted with AI assistance; reviewed and edited by me.