← All permissions
Repository permission·actions:read
Actions: Read
Tier 3 · Low
Why Tier 3
Reads workflow runs, logs, artifacts and caches. Logs and artifacts sometimes contain tokens that were not masked.
Data plane permissions start at Tier 2. This one is lowered for the reason above.
- Target
- Repository
- Plane
- DataWorkflows: Workflow files and runs, variables, deployments, environments and Pages.
- Granted by
- Fine-grained PAT, GitHub App, GITHUB_TOKEN
- Available on
- Every setup
- In a workflow
permissions: actions: read
What it unlocks
34 REST endpoints need this permission. A few of them:
- GET /repos/{owner}/{repo}/actions/artifacts
- GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}
- GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}
- GET /repos/{owner}/{repo}/actions/cache/storage-limit
Roles that include it
- T0OwnerThe organization and every repository in it
- T0All-repository adminEvery repository in the organization
- T1WriteOne repository
- T1MaintainOne repository
- T1AdminOne repository
- T1All-repository writeEvery repository in the organization
- T1All-repository maintainEvery repository in the organization
- T2TriageOne repository
- T2All-repository triageEvery repository in the organization
- T3ReadOne repository
- T3All-repository readEvery repository in the organization
Classic scopes that reach it
- T0repodocumented