Provision GitHub Tokens

A GitHub Action that creates and rotates GitHub tokens that you declare across your repositories.

Glossary

General

Account

A GitHub org or user.

Parties

Provider

The repo that runs this action. Its config sets the auth policy.

Requester

A repo that declares the tokens it wants and where to provision them as secrets.

Consumer

The repo or account that receives an issued token.

Issuer

A GitHub App installation that creates access tokens for requesters.

Provisioner

A GitHub App installation that creates secrets in target accounts and repositories.

Configuration

Tip

Don't confuse declaration with definition. This project uses declarative config. If you see "definition", it's likely a typo.

Provider config

A YAML file in the provider repo. It sets permission rules and provision rules.

Requester config

A YAML file in a requesting repo. It declares the tokens the repo wants issued and where to provision them.

Token declaration

An entry in a requester config that names an account, repositories, and permissions.

Token reference

An ID that points to a token declaration, written <owner>/<repo>.<name>, or as a shorthand: ./<repo>.<name> for a declaration in the same account, or a bare <name> for a declaration in the same repo.

Secret declaration

An entry in a requester config that links a token reference to provision targets.

Authorization

Permission rule

A rule in the provider config. It controls which tokens requesters may obtain for which consumers.

Provision rule

A rule in the provider config. It controls where requesters can provision secrets.

Token authorization

The check that decides whether a consumer can have access to a token with certain permissions and repositories.

Provision authorization

The check that decides whether a requester can provision a secret to a given target.

Permissions boundary

The cap on token permissions. Set by the issuer installation's own grants.

Access level

The access a token grants for a given permission, ranked as: none < read < write < admin.

Provisioning

Token creation result

The result of trying to create an access token after auth checks pass.

Provisioning result

The result of trying to create a secret in a provision target.

Provision target

A secret type plus the account, repo, or environment where the action provisions that secret.

Secret type

The kind of GitHub secret within a provision target: actions, codespaces, dependabot, or environment.