feat: make github-token optional in all action.yml files

locus313 · Copilot · locus313 · commit 36717f9dd24a · 2026-06-26T12:46:48.000-07:00
- Change github-token from required to optional in all 16 existing
  action.yml files; env mapping uses inputs.github-token || github.token
  so the built-in Actions token is used automatically when no PAT is provided
- Add new action.yml for github-repo-permissions-report
- Add new action.yml for github-copilot-report (with no-entra, credits,
  enterprise, and upn-domain inputs)

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/enterprise/github-add-enterprise-team-read-permissions/action.yml b/enterprise/github-add-enterprise-team-read-permissions/action.yml
@@ -3,7 +3,7 @@ description: 'Grant read permissions to an enterprise team across all organizati
 inputs:
   github-token:
     description: 'PAT with admin:enterprise scope'
-    required: true
+    required: false
   enterprise:
     description: 'GitHub Enterprise slug'
     required: true
@@ -24,7 +24,7 @@ runs:
     - name: Add enterprise team read permissions
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ENTERPRISE: ${{ inputs.enterprise }}
         ENTERPRISE_TEAM_SLUG: ${{ inputs.enterprise-team-slug }}
         ALL_REPO_READ_ROLE_NAME: ${{ inputs.all-repo-read-role-name }}
diff --git a/enterprise/github-dockerfile-discovery/action.yml b/enterprise/github-dockerfile-discovery/action.yml
@@ -3,7 +3,7 @@ description: 'Discover Dockerfiles and extract FROM instructions across all ente
 inputs:
   github-token:
     description: 'PAT with read:org and repo scope'
-    required: true
+    required: false
   enterprise:
     description: 'GitHub Enterprise slug'
     required: true
@@ -41,7 +41,7 @@ runs:
     - name: Discover Dockerfiles across enterprise
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ENTERPRISE: ${{ inputs.enterprise }}
         REPORT_DIR: ${{ inputs.report-dir }}
         ORGS: ${{ inputs.orgs }}
diff --git a/enterprise/github-get-consumed-licenses/action.yml b/enterprise/github-get-consumed-licenses/action.yml
@@ -3,7 +3,7 @@ description: 'Report GitHub Enterprise consumed licence seat counts'
 inputs:
   github-token:
     description: 'PAT with manage_billing:enterprise scope'
-    required: true
+    required: false
   enterprise:
     description: 'GitHub Enterprise slug'
     required: true
@@ -17,7 +17,7 @@ runs:
     - name: Get consumed licenses
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ENTERPRISE: ${{ inputs.enterprise }}
         API_URL_PREFIX: ${{ inputs.api-url-prefix }}
       run: ${{ github.action_path }}/github-get-consumed-licenses.sh
diff --git a/enterprise/github-get-public-repos/action.yml b/enterprise/github-get-public-repos/action.yml
@@ -3,7 +3,7 @@ description: 'List all public repositories across all organizations in a GitHub
 inputs:
   github-token:
     description: 'PAT with read:org and repo scope'
-    required: true
+    required: false
   enterprise:
     description: 'GitHub Enterprise slug'
     required: true
@@ -33,7 +33,7 @@ runs:
     - name: Get public repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ENTERPRISE: ${{ inputs.enterprise }}
         REPORT_DIR: ${{ inputs.report-dir }}
         ORGS: ${{ inputs.orgs }}
diff --git a/org-admin/github-add-repo-collaborators-by-pattern/action.yml b/org-admin/github-add-repo-collaborators-by-pattern/action.yml
@@ -3,7 +3,7 @@ description: 'Add individual collaborators to repositories whose names match a r
 inputs:
   github-token:
     description: 'PAT with repo and admin:org scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -31,7 +31,7 @@ runs:
     - name: Add collaborators to matching repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         COLLABORATORS: ${{ inputs.collaborators }}
         REPO_NAME_REGEX: ${{ inputs.repo-name-regex }}
diff --git a/org-admin/github-add-repo-permissions/action.yml b/org-admin/github-add-repo-permissions/action.yml
@@ -3,7 +3,7 @@ description: 'Grant team permissions across all repositories in a GitHub organiz
 inputs:
   github-token:
     description: 'PAT with admin:org scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -41,7 +41,7 @@ runs:
     - name: Grant team permissions to repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         REPO_NAME_FILTER: ${{ inputs.repo-name-filter }}
         REPO_ADMIN: ${{ inputs.repo-admin }}
diff --git a/org-admin/github-archive-old-repos/action.yml b/org-admin/github-archive-old-repos/action.yml
@@ -3,7 +3,7 @@ description: 'Archive repositories that have not been updated within a configura
 inputs:
   github-token:
     description: 'PAT with repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -29,7 +29,7 @@ runs:
     - name: Archive old repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         YEARS_THRESHOLD: ${{ inputs.years-threshold }}
         REPORT_DIR: ${{ inputs.report-dir }}
diff --git a/org-admin/github-auto-repo-creation/action.yml b/org-admin/github-auto-repo-creation/action.yml
@@ -3,7 +3,7 @@ description: 'Create private repositories with branch protection, CODEOWNERS, an
 inputs:
   github-token:
     description: 'PAT with repo and admin:org scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -27,7 +27,7 @@ runs:
     - name: Create repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         REPO_NAMES: ${{ inputs.repo-names }}
         REPO_OWNERS: ${{ inputs.repo-owners }}
diff --git a/org-admin/github-close-archived-repo-security-alerts/action.yml b/org-admin/github-close-archived-repo-security-alerts/action.yml
@@ -3,7 +3,7 @@ description: 'Dismiss all open Dependabot, code-scanning, and secret-scanning al
 inputs:
   github-token:
     description: 'PAT with security_events and repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -37,7 +37,7 @@ runs:
     - name: Close archived repo security alerts
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         DEPENDABOT_REASON: ${{ inputs.dependabot-reason }}
         CODE_SCANNING_REASON: ${{ inputs.code-scanning-reason }}
diff --git a/org-admin/github-enable-issues/action.yml b/org-admin/github-enable-issues/action.yml
@@ -3,7 +3,7 @@ description: 'Enable the Issues feature on all repositories where it is currentl
 inputs:
   github-token:
     description: 'PAT with repo or admin:org scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -21,7 +21,7 @@ runs:
     - name: Enable Issues on repositories
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         API_URL_PREFIX: ${{ inputs.api-url-prefix }}
       run: |
diff --git a/org-admin/github-get-repo-list/action.yml b/org-admin/github-get-repo-list/action.yml
@@ -3,7 +3,7 @@ description: 'Output a CSV list of all repositories in a GitHub organization to
 inputs:
   github-token:
     description: 'PAT with read:org and repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -17,7 +17,7 @@ runs:
     - name: Get repository list
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         API_URL_PREFIX: ${{ inputs.api-url-prefix }}
       run: ${{ github.action_path }}/github-get-repo-list.sh
diff --git a/org-admin/github-import-repo/action.yml b/org-admin/github-import-repo/action.yml
@@ -3,7 +3,7 @@ description: 'Mirror-clone a repository and push it to a new private repository
 inputs:
   github-token:
     description: 'PAT with repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -30,7 +30,7 @@ runs:
     - name: Import repository
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         OWNER_USERNAME: ${{ inputs.owner-username }}
         API_URL_PREFIX: ${{ inputs.api-url-prefix }}
diff --git a/org-admin/github-migrate-internal-repos-to-private/action.yml b/org-admin/github-migrate-internal-repos-to-private/action.yml
@@ -3,7 +3,7 @@ description: 'Convert all internal-visibility repositories in an organization to
 inputs:
   github-token:
     description: 'PAT with repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -17,7 +17,7 @@ runs:
     - name: Migrate internal repos to private
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         API_URL_PREFIX: ${{ inputs.api-url-prefix }}
       run: ${{ github.action_path }}/github-migrate-internal-repos-to-private.sh
diff --git a/org-admin/github-repo-from-template/action.yml b/org-admin/github-repo-from-template/action.yml
@@ -3,7 +3,7 @@ description: 'Create a private repository from a template with team permissions
 inputs:
   github-token:
     description: 'PAT with repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -37,7 +37,7 @@ runs:
     - name: Create repository from template
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         TEMPLATE_REPO: ${{ inputs.template-repo }}
         CD_USERNAME: ${{ inputs.cd-username }}
diff --git a/reporting/github-copilot-report/action.yml b/reporting/github-copilot-report/action.yml
@@ -0,0 +1,40 @@
+name: 'Copilot Report'
+description: 'GitHub Copilot Enterprise licence and AI credit usage report, optionally enriched with Entra ID department data'
+inputs:
+  github-token:
+    description: 'PAT with read:enterprise and manage_billing:enterprise scopes. Cannot be the built-in GITHUB_TOKEN.'
+    required: true
+  enterprise:
+    description: 'GitHub Enterprise slug'
+    required: true
+  upn-domain:
+    description: 'Email domain for Entra ID lookup when GitHub carries no email address (e.g. example.com)'
+    required: false
+    default: ''
+  credits:
+    description: 'Override credits-per-seat value if your portal shows a different pool size'
+    required: false
+    default: ''
+  output:
+    description: 'Output CSV file path (default: copilot-report-YYYYMMDD.csv)'
+    required: false
+    default: ''
+  no-entra:
+    description: 'Skip Entra ID department lookup'
+    required: false
+    default: 'false'
+runs:
+  using: composite
+  steps:
+    - name: Generate Copilot report
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_ENTERPRISE: ${{ inputs.enterprise }}
+        UPN_DOMAIN: ${{ inputs.upn-domain }}
+        CREDITS_PER_SEAT_OVERRIDE: ${{ inputs.credits }}
+      run: |
+        ARGS=()
+        [[ -n "${{ inputs.output }}" ]]   && ARGS+=(--output "${{ inputs.output }}")
+        [[ "${{ inputs.no-entra }}" == "true" ]] && ARGS+=(--no-entra)
+        "${{ github.action_path }}/github-copilot-report.sh" "${ARGS[@]}"
diff --git a/reporting/github-monthly-issues-report/action.yml b/reporting/github-monthly-issues-report/action.yml
@@ -3,7 +3,7 @@ description: 'Generate an HTML report of issues created within a date range'
 inputs:
   github-token:
     description: 'PAT with repo scope'
-    required: true
+    required: false
   org:
     description: 'GitHub organization name'
     required: true
@@ -30,7 +30,7 @@ runs:
     - name: Generate monthly issues report
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
         ORG: ${{ inputs.org }}
         REPO: ${{ inputs.repo }}
         MONTH_START: ${{ inputs.month-start }}
diff --git a/reporting/github-repo-permissions-report/action.yml b/reporting/github-repo-permissions-report/action.yml
@@ -0,0 +1,29 @@
+name: 'Repo Permissions Report'
+description: 'Export repository collaborator/team permissions and branch-approval bypass actors to CSV'
+inputs:
+  github-token:
+    description: 'GitHub token with repo and read:org scopes. Defaults to the built-in GITHUB_TOKEN.'
+    required: false
+  repo:
+    description: 'Target repository in OWNER/REPO format'
+    required: true
+  branch:
+    description: 'Branch to evaluate (default: repository default branch)'
+    required: false
+    default: ''
+  output:
+    description: 'Output CSV file path'
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Generate repository permissions report
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
+      run: |
+        ARGS=(-r "${{ inputs.repo }}")
+        [[ -n "${{ inputs.branch }}" ]] && ARGS+=(-b "${{ inputs.branch }}")
+        [[ -n "${{ inputs.output }}" ]] && ARGS+=(-o "${{ inputs.output }}")
+        "${{ github.action_path }}/github-repo-permissions-report.sh" "${ARGS[@]}"
