GitHub Community
Find permissions and remaining duration for a GITHUB_TOKEN from within a run #163573
Replies: 6 comments 5 replies
|
I’ve run into similar needs while debugging workflows. To view the permissions of the GITHUB_TOKEN during a run, you can inspect the token’s actual access via the GitHub REST API. Here's a useful trick For checking the token’s expiry, unfortunately, the default GITHUB_TOKEN is a short-lived token (valid for the duration of the job) and GitHub doesn’t expose the remaining validity directly during runtime. If you're using a custom fine-grained PAT or GitHub App token, those will have visible expiration and scopes |
1 reply
|
The type of access I am after is not covered by the GET /repos/{owner}/{repo}/actions/permissions endpoint. Im trying to get the settings that the workflow or job is running with. As the screenshot in the description is showing, the data is "somewhere" just not sure where. I want to have that available in my composite action so that can validate that its running with the correct permissions before actually attempting a half-assed deployment of something. Also, not using a custom one. Specifically asking for the GITHUB_TOKEN ;) 🔴 Logs using the suggestion -
|
This comment was marked as off-topic.
This comment was marked as off-topic.
|
Not looking for the ratelimit. Got that one covered. Looking specifically for the permissions granted to the short lived token like the screenshot shows. They are not visible in the X-OAuth-Scopes when running with the GITHUB_TOKEN from a workflow. 🔴 Logs using the suggestion -
|
|
I want to validate in an action where I do not control the implementation of said action in a workflow. ;)
Also I am not using the CLI, so only basing it on the REST/GraphQL calls or available info in the workflow itself (env vars).
Sent from Outlook for iOS<https://aka.ms/o0ukef>
…________________________________
From: Angel ***@***.***>
Sent: Saturday, June 21, 2025 9:38:36 AM
To: community/community ***@***.***>
Cc: Marius Storhaug ***@***.***>; Author ***@***.***>
Subject: Re: [community/community] Find permissions and remaining duration for a GITHUB_TOKEN from within a run (Discussion #163573)
For GitHub Actions token permissions and validity, here are the key approaches:
Getting Token Permissions:
* GitHub API: Use GET /user or GET /repos/{owner}/{repo} with the token - the response headers include X-OAuth-Scopes showing current permissions
* GitHub CLI: Run gh api user in your workflow to check token access
* API calls: Make test calls to endpoints requiring specific permissions to verify access
Checking Token Validity:
* Expiration: GITHUB_TOKEN expires when the workflow job completes (automatically managed)
* Rate limits: Check X-RateLimit-Remaining header in API responses
* Validation: Use gh auth status or gh api user to verify the token is active
Example workflow step:
- name: Check token permissions
run: |
gh api user --jq '.login'
gh api rate_limit --jq '.rate'
Note: GITHUB_TOKEN permissions are defined in your workflow file (permissions: block) or repository settings, so you typically know them in advance. The token is scoped to the specific repository and workflow run.
—
Reply to this email directly, view it on GitHub<#163573 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AEHGXDKM2IGY72JUF3TGTR33EUDXZAVCNFSM6AAAAAB7YU3P3WVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGNJTGYZTINI>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
2 replies
This comment was marked as off-topic.
This comment was marked as off-topic.
|
Same answer as your first comment. |
How to Check GITHUB_TOKEN Permissions and Duration in a Workflow1. Permissions:
2. Remaining Duration:
References: Summary:
Let me know if you need a code snippet or more details! |
1 reply
|
The permissions applied to the workflow run is somehow exposed, as we see in the screenshot. This is from the first task run in a job. So not sure its just getting the workflow and parsing the permission statements in the YAML. However not solved by what you suggest either. |
|
Any other suggestions? |
0 replies
|
🕒 Discussion Activity Reminder 🕒 This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions: 1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as 2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own. 3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution. Note: This dormant notification will only apply to Discussions with the Thank you for helping bring this Discussion to a resolution! 💬 |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Why are you starting this discussion?
Question
What GitHub Actions topic or product is this about?
Misc
Discussion Details
Is there a way to get the permissions (content:read, issue:write etc) for a GITHUB_TOKEN from within a run?
Also is there a way to find its remaining validity?All reactions