feat: Add configurable permissions for Actions automatic tokens #36173

Excellencedev · 2025-12-17T06:20:07Z

Summary

Implements Issue #24635 - Support configuring permissions of automatic tokens for Actions jobs.

This PR adds the ability to configure the default permissions granted to the GITHUB_TOKEN when running workflow jobs in a repository. Users can now choose between:

Permissive mode (default): Workflows have read and write permissions for all scopes (backwards compatible with existing behavior)
Restricted mode: Workflows have read-only permissions by default

Changes

Backend

Extended ActionsConfig struct in models/repo/repo_unit.go with:
- ActionsTokenPermissionMode type (permissive/restricted)
- ActionsTokenPermissions struct for per-unit permissions (Contents, Issues, PullRequests, Packages, Actions, Wiki)
- Helper methods for getting effective permissions and clamping
Modified GetActionsUserRepoPermission in models/perm/access/repo_permission.go to use configurable per-unit permissions instead of hardcoded access modes
Added UpdateTokenPermissions handler in routers/web/repo/setting/actions.go

Frontend

Added Token Permissions UI section in repository Settings → Actions → General
Added locale strings in options/locale/locale_en-US.ini

Tests

Added unit tests in models/repo/repo_unit_test.go for token permission methods
Added integration test TestActionsTokenPermissionsModes in tests/integration/actions_job_token_test.go

Screenshots

The new Token Permissions section appears in Settings → Actions → General:

Radio buttons for Permissive/Restricted mode
Warning note about fork PRs always being read-only

Notes

Fork pull requests always receive read-only access regardless of settings (security feature)
Default behavior is "permissive" for backwards compatibility
No database migration required - settings stored as JSON in existing repo_unit config

Related Issues

Closes #24635
/claim #24635

Excellencedev · 2025-12-17T11:31:19Z

@lunny @wxiaoguang Please review this

wxiaoguang · 2025-12-17T12:30:54Z

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

Excellencedev · 2025-12-17T14:29:21Z

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

@silverwind Please review

silverwind · 2025-12-17T17:14:54Z

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

Excellencedev · 2025-12-17T17:30:04Z

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

No problem

Zettat123 · 2025-12-17T18:20:05Z

routers/web/repo/setting/actions.go

+	ctx.Data["TokenPermissionModePermissive"] = repo_model.ActionsTokenPermissionModePermissive
+	ctx.Data["TokenPermissionModeRestricted"] = repo_model.ActionsTokenPermissionModeRestricted
+	ctx.Data["EffectiveTokenPermissions"] = actionsCfg.GetEffectiveTokenPermissions(false)
+	ctx.Data["MaxTokenPermissions"] = actionsCfg.GetMaxTokenPermissions()


EffectiveTokenPermissions and MaxTokenPermissions are not being used on the frontend page. Should they be removed?

Zettat123 · 2025-12-17T18:23:59Z

routers/web/repo/setting/actions.go

+	permissionMode := ctx.FormString("token_permission_mode")
+	if permissionMode == string(repo_model.ActionsTokenPermissionModeRestricted) {
+		actionsCfg.TokenPermissionMode = repo_model.ActionsTokenPermissionModeRestricted
+	} else {


When permissionMode is not "permissive" or "restricted", it's better to return 400 Bad Request

Zettat123 · 2025-12-17T18:26:06Z

tests/integration/actions_job_token_test.go

+	})
+}
+
+func testActionsTokenPermissionsMode(u *url.URL, mode string, expectReadOnly bool) func(t *testing.T) {


mode and expectReadOnly params are unused, is this as expected?

We have unparam linter enabled, it should error on any unused params.

wxiaoguang · 2025-12-17T19:01:16Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

Zettat123 · 2025-12-17T20:53:54Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

silverwind · 2025-12-18T01:44:40Z

templates/repo/settings/actions_general.tmpl

+					</div>
+				</div>
+			</div>
+			<div class="ui warning message">


Maybe ui info message is enough. Warning should only be used for dangerous stuff.

silverwind · 2025-12-18T01:47:54Z

Issues I see on this screenshot:

Header text is black on dark theme
Contrast on light text is too low

I can probably help fix those, the first one may be a missing override of the fomantic CSS.

Excellencedev · 2025-12-18T01:53:03Z

@Zettat123 @silverwind Pls give me a few hours(15-20 hours) and this PR will be ready to go
I will make sure to address all your comments and make sure I do everything from the issue
Drafting until then
When it is done, I will undraft it and notify you

wxiaoguang · 2025-12-18T01:57:15Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

Excellencedev · 2025-12-18T01:59:50Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

wxiaoguang · 2025-12-18T02:07:38Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

I don't know. Reviewers decide.

Zettat123 · 2025-12-18T02:09:57Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

I reviewed both PRs, but did not receive responses to my comments in #36113. If @Excellencedev will address the review comments, I think we should keep this PR.

silverwind · 2025-12-18T02:12:59Z

Imho, the only sensible thing we can do is race these 2 PRs.

feat: Add configurable permissions for Actions automatic tokens

3a10e8f

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 17, 2025

algora-pbc bot added the 🙋 Bounty claim label Dec 17, 2025

github-actions bot added modifies/translation modifies/go Pull requests that update Go code modifies/templates This PR modifies the template files labels Dec 17, 2025

Merge branch 'main' into fix-24635

249794c

lunny requested a review from Zettat123 December 17, 2025 16:53

Zettat123 reviewed Dec 17, 2025

View reviewed changes

Merge branch 'main' into fix-24635

e20d12e

silverwind reviewed Dec 18, 2025

View reviewed changes

Excellencedev marked this pull request as draft December 18, 2025 01:53

Uh oh!

feat: Add configurable permissions for Actions automatic tokens #36173

Are you sure you want to change the base?

feat: Add configurable permissions for Actions automatic tokens #36173

Conversation

Excellencedev commented Dec 17, 2025

Summary

Changes

Backend

Frontend

Tests

Screenshots

Notes

Related Issues

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

wxiaoguang commented Dec 17, 2025

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

silverwind commented Dec 17, 2025

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

Zettat123 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Zettat123 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Zettat123 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

silverwind Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wxiaoguang commented Dec 17, 2025

Uh oh!

Zettat123 commented Dec 17, 2025

Uh oh!

silverwind Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

silverwind commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

wxiaoguang commented Dec 18, 2025

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

wxiaoguang commented Dec 18, 2025

Uh oh!

Zettat123 commented Dec 18, 2025

Uh oh!

silverwind commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

silverwind Dec 18, 2025 •

edited

Loading

silverwind commented Dec 18, 2025 •

edited

Loading

silverwind commented Dec 18, 2025 •

edited

Loading