ghtier
← All roles
Organization role·The organization's Actions setup

CI/CD admin

Tier 1 · HighManagement

Why Tier 1

Tier 1 because it includes Network configurations: Write (organization), Secrets: Write (organization), Self-hosted runners: Write (organization) and 1 more.

Manages Actions policies, runners, runner groups, hosted compute networks, secrets, variables and usage metrics.

Available on: Every setup. Source

Permissions it includes (5)

TierPermissionFrom
T1sets tierAdministration: Writeorganization

In part, counts as T1 (the full permission is T0): Only the Actions policy part of organization Administration: which actions may run and what workflow tokens get.

  • Actions policies are part of organization Administration.
inferred
T1sets tierNetwork configurations: Writeorganization
  • Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics.
documented
T1sets tierSecrets: Writeorganization
  • Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics.
documented
T1sets tierSelf-hosted runners: Writeorganization
  • Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics.
documented
T2Variables: Writeorganization
  • Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics.
documented

Attack paths

Techniques it enables

Escalations it starts

  • Register a self-hosted runner: Every job routed to that runner, with the secrets those jobs receive, and a foothold that outlives the stolen token. · through Self-hosted runners: Write (org)

GitHub Docs for this role