GitHub Community
Are there plans to allow the Actions token to modify secrets? #26292
-
|
I worked on an Action to rotate AWS access keys that are stored as secrets in my repository. To my dismay, it fails at the point of accessing the public key required to encrypt the new values with the dreaded Are there plans to allow Actions to update secrets? I know i can create a personal access token, but that seems like a bad hack. |
Beta Was this translation helpful? Give feedback.
Replies: 6 comments
-
|
Using the GitHub API, you can currently update a secret: https://developer.github.com/v3/actions/secrets/#create-or-update-a-secret-for-a-repository Note that this GitHub Actions API is currently in Public Beta and could change without warning. |
Beta Was this translation helpful? Give feedback.
-
|
I know about that api. The token provided by actions is not scoped to have access. Hence my question |
Beta Was this translation helpful? Give feedback.
-
|
Right, that seems like it’s by design. It does not make much sense from a security standpoint to allow a GitHub action itself to have the power to update, delete, or add GitHub secrets. I think the only way for this to occur is to use a Personal Access Token (which I think is how you access pretty much all of the GitHub API). |
Beta Was this translation helpful? Give feedback.
-
|
Yes, we did this intentionally. If the token had secret access, any Action with the token could modify the repositories secrets. You’ll need to use a PAT to use the Secrets API from within Actions. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, we desperately need this feature. We want to have a cron job that rotates the repository own aws credentials on a regular base. |
Beta Was this translation helpful? Give feedback.
-
|
mscoutermarsh:
@mscoutermarsh seems like there is an issue even using the PAT: Can't read secrets public key of a public repository Can you confirm whether there is a workaround? |
Beta Was this translation helpful? Give feedback.
Yes, we did this intentionally. If the token had secret access, any Action with the token could modify the repositories secrets.
You’ll need to use a PAT to use the Secrets API from within Actions.