{"id":46059453,"url":"https://github.com/step-security/gha-repo-manager","last_synced_at":"2026-03-01T11:03:44.058Z","repository":{"id":323668789,"uuid":"1094103373","full_name":"step-security/gha-repo-manager","owner":"step-security","description":"Manage your Github repo(s) settings and secrets using Github Actions and a yaml file. Secure drop-in replacement for andrewthetechie/gha-repo-manager.","archived":false,"fork":false,"pushed_at":"2026-01-21T05:44:56.000Z","size":398,"stargazers_count":0,"open_issues_count":8,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-21T17:27:55.017Z","etag":null,"topics":["step-security-maintained-actions"],"latest_commit_sha":null,"homepage":"https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/step-security.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-11T09:03:45.000Z","updated_at":"2026-01-21T05:43:35.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/step-security/gha-repo-manager","commit_stats":null,"previous_names":["step-security/gha-repo-manager"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/step-security/gha-repo-manager","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fgha-repo-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fgha-repo-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fgha-repo-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fgha-repo-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/step-security","download_url":"https://codeload.github.com/step-security/gha-repo-manager/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fgha-repo-manager/sbom","scorecard":{"id":1242054,"data":{"date":"2026-01-21T05:44:05Z","repo":{"name":"github.com/step-security/gha-repo-manager","commit":"680cfd27664f0a567f666ce7f16ecc55fd004946"},"scorecard":{"version":"v5.0.0","commit":"ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4"},"score":7.2,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is required - but no codeowners file found in repo","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":10,"reason":"11 out of 11 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#code-review"}},{"name":"Contributors","score":3,"reason":"project has 1 contributing companies or organizations -- score normalized to 3","details":["Info: stepsecurity contributor org/company found, "],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"project was created in last 90 days. please review its contents carefully","details":["Warn: Repository was created in last 90 days."],"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#maintained"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker.yml:16"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":8,"reason":"dependency not pinned by hash detected -- score normalized to 8","details":["Warn: pipCommand not pinned by hash: Dockerfile:11","Warn: pipCommand not pinned by hash: .github/workflows/python-ci.yml:42","Warn: pipCommand not pinned by hash: .github/workflows/python-ci.yml:56","Info:  13 out of  13 GitHub-owned GitHubAction dependencies pinned","Info:  14 out of  14 third-party GitHubAction dependencies pinned","Info:   1 out of   4 pipCommand dependencies pinned","Info:   1 out of   1 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":10,"reason":"1 out of the last 1 releases have a total of 1 signed artifacts.","details":["Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/gha-repo-manager/releases/assets/315574305"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/actions_release.yml:18","Info: jobLevel 'actions' permission set to 'read': .github/workflows/actions_release.yml:16","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:31","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:32","Info: jobLevel 'contents' permission set to 'read': .github/workflows/python-ci.yml:12","Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:30","Info: jobLevel 'issues' permission set to 'read': .github/workflows/scorecards.yml:32","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/scorecards.yml:33","Info: jobLevel 'checks' permission set to 'read': .github/workflows/scorecards.yml:35","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:29","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test-docker-image.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/actions_release.yml:11","Warn: topLevel 'contents' permission set to 'write': .github/workflows/auto_cherry_pick.yml:19","Info: topLevel 'packages' permission set to 'read': .github/workflows/auto_cherry_pick.yml:21","Info: topLevel 'contents' permission set to 'read': .github/workflows/claude_review.yml:14","Info: topLevel 'packages' permission set to 'read': .github/workflows/claude_review.yml:16","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/docker.yml:12","Warn: topLevel 'packages' permission set to 'write': .github/workflows/docker.yml:13","Info: found token with 'none' permissions: .github/workflows/python-ci.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:18","Info: found token with 'none' permissions: .github/workflows/test-docker-image.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":7,"reason":"3 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-qmgc-5h2g-mvrw","Warn: Project is vulnerable to: GHSA-w853-jp5j-5j7f","Warn: Project is vulnerable to: GHSA-597g-3phw-6986"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2026-01-21T17:37:07.654Z","repository_id":323668789,"created_at":"2026-01-21T17:37:07.654Z","updated_at":"2026-01-21T17:37:07.654Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29967932,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T10:55:55.490Z","status":"ssl_error","status_checked_at":"2026-03-01T10:55:55.175Z","response_time":124,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["step-security-maintained-actions"],"created_at":"2026-03-01T11:03:43.559Z","updated_at":"2026-03-01T11:03:44.040Z","avatar_url":"https://github.com/step-security.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Repo Manager via Github Actions\n\n\u003c!-- action-docs-description --\u003e\n## Description\n\nManage your Github repo(s) settings and secrets using Github Actions and a yaml file\n\n\n\u003c!-- action-docs-description --\u003e\n\n## Usage\n\nThis action manages your repo from a yaml file. You can manage:\n\n* branch protection\n* labels\n* repos\n* secrets\n* repo settings\n* Files\n\nSee [examples/settings.yml](./examples/settings.yml) for an example config file. The schemas for this file are in [repo_manager.schemas](./repo_manager/schemas).\n\n### File Management -- Experimental\n\nFile management can copy files from your local environment to a target repo, copy files from one location to another in the target repo, move files in the target repo, and delete files in the target repo.\n\nFile operations are performed using the Github BLOB API and your PAT. Each file operation is a separate commit.\n\nThis feature is helpful to keep workflows or settings file in sync from a central repo to many repos.\n\n### Example workflow\n\n```yaml\nname: Run Repo Manager\non: [workflow_dispatch]\njobs:\n  repo-manager:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v5\n    name: Checkout\n    - name: Run RepoManager\n      uses: step-security/gha-repo-manager@v1\n      with:\n        # Apply your settings to the repo, can also be check to just check repo settings vs your file or validate, to validate your\n        # file is valid\n        action: apply\n        settings_file: .github/settings.yml\n        # need a PAT that can edit repo settings\n        token: ${{ secrets.GITHUB_PAT }}\n\n```\n\n\u003c!-- action-docs-inputs --\u003e\n## Inputs\n\n| parameter | description | required | default |\n| - | - | - | - |\n| action | What action to take with this action. One of validate, check, or apply. Validate will validate your settings file, but not touch your repo. Check will check your repo with your settings file and output a report of any drift. Apply will apply the settings in your settings file to your repo | `false` | check |\n| settings_file | What yaml file to use as your settings. This is local to runner running this action. | `false` | .github/settings.yml |\n| repo | What repo to perform this action on. Default is self, as in the repo this action is running in | `false` | self |\n| github_server_url | Set a custom github server url for github api operations. Useful if you're running on GHE. Will try to autodiscover from env.GITHUB_SERVER_URL if left at default | `false` | none |\n| token | What github token to use with this action. | `true` |  |\n\n\n\n\u003c!-- action-docs-inputs --\u003e\n\n\u003c!-- action-docs-outputs --\u003e\n## Outputs\n\n| parameter | description |\n| - | - |\n| result | Result of the action |\n| diff | Diff of this action, dumped to a json string |\n\n\n\n\u003c!-- action-docs-outputs --\u003e\n\n\u003c!-- action-docs-runs --\u003e\n## Runs\n\nThis action is a `docker` action.\n\n\n\u003c!-- action-docs-runs --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fgha-repo-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstep-security%2Fgha-repo-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fgha-repo-manager/lists"}