I have a repository which contains deploy keys. I want a workflow job which periodically checks whether any of the deploy keys are reaching their maximum allowed age before they must be rotated. I tried writing a workflow like this, using the GITHUB_TOKEN, but it looks like it doesn't have the necessary privileges. My repository belongs to a GitHub Organization.

name: Check age of repository deploy key

# This workflow is triggered on pushes to the repository.
on:
  push:
  schedule:
    # Runs 06:00 every day
    - cron:  '0 6 */1 * *'

jobs:
  expiry_check:
    env:
      DEPLOY_KEY_METADATA_URL: https://api.github.com/repos/my_org/my_repo/keys
      DEPLOY_KEY_MAX_AGE: 3600*24*365   # 1 year
      

      # This job runs on Linux
    runs-on: ubuntu-latest

    steps:
      # GitHub repository checkout
      - name: GitHub repository checkout
        uses: actions/checkout@v1


      - name: Check if any deploy keys are approaching their expiry data
        run: |
          python3 -c "import requests;import sys;url=sys.argv[1];token=sys.argv[2];r=requests.get(url, headers={'Authorization': f'Bearer {token}'});print(r.text)" $DEPLOY_KEY_METADATA_URL ${{ secrets.GITHUB_TOKEN }}

The response to my API request has this error: {"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/reference/repos#list-deploy-keys"}

Is there some other solution to this problem, besides personal access tokens and GitHub Apps? The first option is not feasible; business logic can't break when an employee leaves the GitHub Organization. I suppose I could make a GitHub App, but I'd rather avoid that too, if I can. I'm not an admin in my GitHub Organization.

0

There are 0 answers