github-actions-allow-list-as-code-action

Automate GitHub Actions allow list for GitHub Enterprise accounts

Usage

name: Deploy GitHub Actions allow list

on:
  push:
    branches: [main]
    paths: [github-actions-allow-list.yml]

jobs:
  deploy:
    runs-on: ubuntu-latest

    permissions: read-all

    steps:
      - name: Checkout
        uses: actions/[email protected]

      - name: Setup node
        uses: actions/[email protected]
        with:
          node-version: 14.x

      - name: Deploy GitHub Actions allow list
        uses: ActionsDesk/[email protected]
        with:
          token: ${{ secrets.ENTERPRISE_ADMIN_TOKEN }}
          enterprise: 'your-enterprise'
          # same as defined under `on.pull_requests.paths`
          allow_list_path: github-actions-allow-list.yml
          # gh_api_url: 'https://github.example.com/api/v3' # Only required for GitHub Enterprise Server

Action Inputs

Name	Description	Default	Required
token	GitHub Personal Access Token (PAT) with admin:enterprise or admin:org scope		true
organization	GitHub organization slug		false
enterprise	GitHub Enterprise account slug		false
allow_list_path	Path to the GitHub Actions allow list YML within the repository	github-actions-allow-list.yml	false
gh_api_url	GitHub Enterprise Servier - URL to the GitHub API endpoint. Example: https://github.example.com/api/v3.	https://api.github.com	false

ℹ️ Notes for providing enterprise or organization:

• Either provide enterprise to update the GitHub Enterprise Cloud's actions allow list, or organization to update a single organization's allow list.
• Providing both will result in the action run failing with Please provide only one of: enterprise, organization.
• If providing organization, but the allow list is handled via GitHub Enterprise Cloud's actions allow list, the action run will fail with Selected actions are already set at the enterprise level.

Allow List file

Example content for Allow List file containing actions: key and list with two allowed actions.

actions:
  - actionsdesk/[email protected]
  - hashicorp/[email protected]

License

• MIT License