Repository permission·actions:write

Actions: Write

Tier 1 · High

Why Tier 1

Starts, re-runs and cancels workflows and deletes caches and artifacts. Starting a privileged publish or deploy job by hand was the step that mattered in the Nx incident.

Data plane permissions start at Tier 2. This one is raised for the reason above.

Target: Repository
Plane: DataWorkflows: Workflow files and runs, variables, deployments, environments and Pages.
Granted by: Fine-grained PAT, GitHub App, GITHUB_TOKEN
Available on: Every setup
In a workflow: permissions: actions: write

What it unlocks

15 REST endpoints need this permission. A few of them:

DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}
DELETE /repos/{owner}/{repo}/actions/caches
DELETE /repos/{owner}/{repo}/actions/caches/{cache_id}
POST /repos/{owner}/{repo}/actions/jobs/{job_id}/rerun

Roles that include it

T0OwnerThe organization and every repository in it
T0All-repository adminEvery repository in the organization
T1WriteOne repository
T1MaintainOne repository
T1AdminOne repository
T1All-repository writeEvery repository in the organization
T1All-repository maintainEvery repository in the organization

Classic scopes that reach it

T0repodocumented

Attack paths

Techniques it enables

Delete branches and workflow runs Delete code or cover tracks
Trigger the publish workflow from a tampered branch Poison the build or published package

Escalations it starts

Start a privileged publish job by hand: Whatever the publish job holds: package registry tokens and the right to publish.

Abused in

Nx "s1ngularity"

Fixed or limited by

Other levels

T3Actions: Read

GitHub Docs: Repository permissions for "Actions"