Help
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Copilot Lvl 3
Message 1 of 5

Are there plans to allow the Actions token to modify secrets?

Solved! Go to Solution.

I worked on an Action to rotate AWS access keys that are stored as secrets in my repository. To my dismay, it fails at the point of accessing the public key required to encrypt the new values with the dreaded

Resource not accessible by integration  

 

Are there plans to allow Actions to update secrets? I know i can create a personal access token, but that seems like a bad hack.

4 Replies
Highlighted
Commander Lvl 1
Message 2 of 5

Re: Are there plans to allow the Actions token to modify secrets?

Using the GitHub API, you can currently update a secret: https://developer.github.com/v3/actions/secrets/#create-or-update-a-secret-for-a-repository

 

Note that this GitHub Actions API is currently in Public Beta and could change without warning. 

Highlighted
Copilot Lvl 3
Message 3 of 5

Re: Are there plans to allow the Actions token to modify secrets?

I know about that api. The token provided by actions is not scoped to have access. Hence my question
Highlighted
Commander Lvl 1
Message 4 of 5

Re: Are there plans to allow the Actions token to modify secrets?

Right, that seems like it's by design. It does not make much sense from a security standpoint to allow a GitHub action itself to have the power to update, delete, or add GitHub secrets. I think the only way for this to occur is to use a Personal Access Token (which I think is how you access pretty much all of the GitHub API). 

Highlighted
Solution
GitHub Staff
Message 5 of 5

Re: Are there plans to allow the Actions token to modify secrets?

Yes, we did this intentionally. If the token had secret access, any Action with the token could modify the repositories secrets.

 

You'll need to use a PAT to use the Secrets API from within Actions.