PUT/repos/{owner}/{repo}/actions/permissions/selected-actions

Set allowed actions and reusable workflows for a repository

Sets the actions and reusable workflows that are allowed in a repository. To use this endpoint, the repository permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for a repository."

OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.

RetriesRetries up to 2×, 500ms backoff, 30s timeout.

2 parameters · 3 body fields

ownerstringrequired

The account owner of the repository. The name is not case sensitive.

repostringrequired

The name of the repository without the `.git` extension. The name is not case sensitive.

github_owned_allowedbooleanoptional

Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.

verified_allowedbooleanoptional

Whether actions from GitHub Marketplace verified creators are allowed. Set to `true` to allow all actions by GitHub Marketplace verified creators.

patterns_allowedarray<string>optional

Specifies a list of string-matching patterns to allow specific action(s) and reusable workflow(s). Wildcards, tags, and SHAs are allowed. For example, `monalisa/octocat@*`, `monalisa/octocat@v2`, `monalisa/*`. > [!NOTE] > The `patterns_allowed` setting only applies to public repositories.

1 status code

204Response

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.selectedActions.update({
  owner: "octocat",
  repo: "hello-world",
  githubOwnedAllowed: true,
  verifiedAllowed: true,
  patternsAllowed: [],
});