feat: Add configurable permissions for Actions automatic tokens

[Excellencedev]

Summary

Implements Issue #24635 - Support configuring permissions of automatic tokens for Actions jobs.

This PR adds the ability to configure the default permissions granted to the GITHUB_TOKEN when running workflow jobs in a repository. Users can now choose between:

• Permissive mode (default): Workflows have read and write permissions for all scopes (backwards compatible with existing behavior)
• Restricted mode: Workflows have read-only permissions by default

Changes

Backend

• Extended ActionsConfig struct in models/repo/repo_unit.go with:

  • ActionsTokenPermissionMode type (permissive/restricted)
  • ActionsTokenPermissions struct for per-unit permissions (Contents, Issues, PullRequests, Packages, Actions, Wiki)
  • Helper methods for getting effective permissions and clamping

• Modified GetActionsUserRepoPermission in models/perm/access/repo_permission.go to use configurable per-unit permissions instead of hardcoded access modes

• Added UpdateTokenPermissions handler in routers/web/repo/setting/actions.go

Frontend

• Added Token Permissions UI section in repository Settings → Actions → General
• Added locale strings in options/locale/locale_en-US.ini

Tests

• Added unit tests in models/repo/repo_unit_test.go for token permission methods
• Added integration test TestActionsTokenPermissionsModes in tests/integration/actions_job_token_test.go

Screenshots

The new Token Permissions section appears in Settings → Actions → General:

• Radio buttons for Permissive/Restricted mode
• Warning note about fork PRs always being read-only

Notes

• Fork pull requests always receive read-only access regardless of settings (security feature)
• Default behavior is "permissive" for backwards compatibility
• No database migration required - settings stored as JSON in existing repo_unit config

Related Issues

Closes #24635
/claim #24635

[Excellencedev]

@lunny @wxiaoguang Please review this

[wxiaoguang]

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

[Excellencedev]

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

@silverwind Please review

[silverwind]

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

[Excellencedev]

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

No problem

[wxiaoguang]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

[Zettat123]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

[silverwind]

Issues I see on this screenshot:

• Header text is black on dark theme
• Contrast on light text is too low

I can probably help fix those, the first one may be a missing override of the fomantic CSS.

[Excellencedev]

@Zettat123 @silverwind Pls give me a few hours(15-20 hours) and this PR will be ready to go
I will make sure to address all your comments and make sure I do everything from the issue
Drafting until then
When it is done, I will undraft it and notify you

[wxiaoguang]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

[Excellencedev]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

[wxiaoguang]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

I don't know. Reviewers decide.

[Zettat123]

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

I reviewed both PRs, but did not receive responses to my comments in #36113. If @Excellencedev will address the review comments, I think we should keep this PR.

[silverwind]

Imho, the only sensible thing we can do is race these 2 PRs.

[Excellencedev]

Adressed most your comments in my latest commit, now i just need to make sure i fully implement the proposal in #24635

[Zettat123]

According to the solution in #24635, I think this PR does not implement:

• Support configuring the permissions
• Support configuring access between repositories
• Private packages can be accessed by Actions only when they have been linked to repositories

[Excellencedev]

According to the solution in #24635, I think this PR does not implement:

• Support configuring the permissions
• Support configuring access between repositories
• Private packages can be accessed by Actions only when they have been linked to repositories

Ok no problem. I'm working on it

[Excellencedev]

@Zettat123 My PR is now ready for review !
It implements ALL the features in the issue description
Just need t make sure tests pass though

[Zettat123]

HasRead and HasWrite can be combined into a single function like

func (p ActionsTokenPermissions) HasAccess(scope string, required perm.AccessMode) bool {
	var mode perm.AccessMode
	switch scope {
	case "actions":
		mode = p.Actions
	case "contents":
		mode = p.Contents
	case "issues":
		mode = p.Issues
	case "packages":
		mode = p.Packages
	case "pull_requests":
		mode = p.PullRequests
	case "wiki":
		mode = p.Wiki
	}
	return mode >= required
}

[Zettat123]

Should be 2025. Please also check other files.

[Zettat123]

Is this a TODO? Should we check the permission from GetActionsUserRepoPermission?

[Zettat123]

I got a 500 Error on repo/settings/actions