Repository navigation
What pemission scopes does the action need for the generated GITHUB_TOKEN? #220
Description
Hello there, hope everything is fine
I was wondering which permission scopes should I grant for the PAT (personal access token) of changesets action.
Below is the list of permission scopes available for PATs, I have some ambiguity to choose some of them.
And there's also some problem with this approach of giving PAT as github_token to the action, since the PAT gives access to all repos and you can't limit the scope.
Isn't there any better approach for that?
Activity
Andarist commentedon Oct 9, 2022
Quite frankly - I'm not entirely sure. Those permissions are always confusing to me. Especially since they don't correspond 1 to 1 to the permissions for the workflow jobs.
What we need is:
This would be definitely useful information to have in the docs but it requires some experimentation to figure out which minimal combination of those scopes would allow the action to function properly.
You can create a new "bot"-like account, limit its access to a particular repo and generate PAT for that account.
frangio commentedon Jan 2, 2023
You can find the required permissions by looking up the REST endpoints in Permissions required for fine-grained personal access tokens.
Edit: Hm, these don't look like the ones in the screenshot. But see section below.
You should look into Fine-grained PATs. You can scope them by repository.
ernestognw commentedon Jan 13, 2023
To summarize, the permissions required are:
If you don't publish using Changesets, Releases is not required although it falls inside of the Contents category
dstaley commentedon Jan 19, 2023
For anyone thinking of using fine-grained tokens, be aware that they don't currently support the GraphQL API, which is required for
@changesets/changelog-github:Andarist commentedon Jan 19, 2023
I'm using those in XState and it works fine (but I don't use the GraphQL API there):
https://github.com/statelyai/xstate/blob/aad4991b4eb04faf979a0c8a027a5bcf861f34b3/.github/workflows/release.yml#L13-L16
I'd appreciate it if somebody could prepare a PR documenting this.
dstaley commentedon Jan 19, 2023
@Andarist ah sorry! I'm so used to the GitHub changelogs that I forgot it's not the default configuration. I've edited my comment to be more accurate. Thanks for the clarification!
kenneth-gray commentedon Jan 28, 2023
@ernestognw Is this using the fine-grained tokens? I haven't been able to get this to work with just those 2 read/write permissions.
kenneth-gray commentedon Jan 29, 2023
I can confirm that these permissions work as expected. I struggled to get the token recognised. As seen in some other issues, adding the PAT token as part of the GitHub checkout action solved my problem.
nyonson commentedon Feb 23, 2023
@kenneth-gray did you get this working by not using the
changeset version? I still getPersonal access tokens with fine grained access do not support the GraphQL APIeven with the PAT using those permissions and set on both the checkout action and changeset action.🐛 github release workflows require permissions
🐛 pin pnpm version in workflows (#379)
bluwy commentedon Sep 4, 2026
We now document the required permissions like this:
This applies to the job permissions that controls the given
GITHUB_TOKENor the default token the action uses even if you didn't pass it specifically.For PATs though, they scope permissions differently and I think the best way is to check if they cover the job permissions as we describe. For classic PATs, I think the
reposcope would cover all that's needed. But it's a broad set of permissions, so you may still want to consider configuring through job permissions instead to prevent potential security issues.