A GitHub Action to generate reports that contain all the SSH keys, personal access tokens, GitHub App installations, deploy keys and their respective permissions authorized against a GitHub organization.

The example workflow below runs on a weekly schedule and can also be executed manually using a workflow_dispatch event.

name: Organization Authorization Action

on:
  schedule:
    # Runs on every Sunday at 00:00 UTC
    #
    #        ┌────────────── minute
    #        │ ┌──────────── hour
    #        │ │ ┌────────── day (month)
    #        │ │ │ ┌──────── month
    #        │ │ │ │ ┌────── day (week)
    - cron: '0 0 * * 0'
  workflow_dispatch:

jobs:
  github-authorization-report:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Get authorization report
        uses: nicklegan/github-org-authorization-action@v2.2.0
        with:
          token: ${{ secrets.ORG_TOKEN }}
        # org: ''
        # app-sort: 'install_id'
        # app-sort-order: 'desc'
        # ssh-sort: 'credential_authorized_at'
        # ssh-sort-order: 'desc'
        # pat-sort: 'credential_authorized_at'
        # pat-sort-order: 'desc'
        # deploy-keys-sort: 'date'
        # deploy-keys-sort-order: 'desc'
        # json: 'false'
        # actor: 'false'

💡 Disable token expiration to avoid failed workflow runs when running on a schedule.

💡 If the organization has SAML SSO enabled, make sure the personal access token is authorized to access the organization.

💡 JSON naming details used for sorting columns in the workflow file are specified below.

💡 The actor flag is set to include organization members responsible for installing and adding selected repos to the GitHub App installation in the report. This feature is experimental as it queries the GitHub audit log which only has a 90 day retention period, after this period the data will become unavailable.

A CSV report file will be saved in the repository reports folder using the following naming format: organization-auth-type.csv.