Using Secrets in Composite Actions GitHub

user_8344506 0
Viewed 5431

I am creating a composite action and I am trying to use the secrets supplied by GitHub but I am running into errors stating that secrets are not found.

This could be recreated with your action.yml looking like:

name: 'test'
description: 'test'
runs:
  using: 'composite'
  steps:
    - name: Create Branch
      run: echo "git branch test"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      shell: bash

The composite actions seem to have no knowledge of secrets which make it hard to run git commands via them.

github-actions
1 Answers

As rethab stated in the comment above. If you need to use secrets inside an action, those secrets need to be informed via action inputs.

In your case, the action.yml file should look like this:

name: 'test'

description: 'test'

inputs:
  token:
    description: 'A Github PAT'
    required: true

runs:
  using: 'composite'
  steps:
    - name: Create Branch
      run: echo "git branch test"
      env:
        GITHUB_TOKEN: ${{ inputs.token }}
      shell: bash

GHA works this way for a security reason, as you wouldn't need the consent from the users to manipulate their repository secrets if it was possible to manage them directly inside some actions.

That way, you guarantee the user will need to inform the secret and give this access from its workflow when using the action.

user_84964620
Related