Reading GitHub from a Workflow

The GitHub Connection

A workflow can read your own repository through your own GitHub connection. An owner or admin adds it in Settings, Connections, Connected Services, then Connect a Service, then GitHub.

• Make the token in GitHub, under Settings, Developer settings, Fine-grained tokens, Generate new token. Choose only the repositories to read, then set Contents and Metadata to Read only. It starts with github_pat_.
• Paste the token, and list the repositories it may read as owner/name, separated by commas.
• Check Now reads one repository's name, never its content, and says in plain words if the token cannot read it.

The token is sealed in your account and is never shown again, returned, or logged. The connection is the account's own, and nothing falls back to another account's token. This connection only reads. A workflow cannot commit, comment, or change anything on GitHub, and a step can read only the repositories you listed.

The Steps

Each step is free to add, counts as one step, and only reads. Each can be tried with Test Run, which checks the connection and the step and reads nothing.

• Read a File From GitHub (action github.read_file): the repository, the path, and a branch or commit. It answers the text, the commit, and the path. A file over 200,000 characters, a picture or program, and a folder are refused with a plain sentence. Use the commit of the push, and the text is exactly what was pushed, even if a newer push has landed since.
• List the Files a Push Changed (action github.changed_files): hands on the files added, changed, and removed by the push that started the workflow. A folder filter (only paths under docs) and a name filter (*.md) keep the list short. When GitHub cuts a push's own list short, the step compares the two commits through GitHub, still only reading, so nothing is missed.
• Read a Folder on GitHub (action github.read_folder): the file paths in a folder and the commit they were read at, up to 500, so a workflow can start from everything in a folder for a first fill or a repair run. A person can start it with Run.

Reading Each Changed File

Start the workflow from a push (see Starting a Workflow From Another Service). Add List the Files a Push Changed with the files added, changed, and removed from What Started It. Then add Repeat for each item over the files added, and inside it Read a File From GitHub with the item as the path and the push's commit. The text goes on to the next step, for example Saving Website Pages From a Repository. A removed file is not read.

What Is Kept

A run keeps the text of a file only so the next step can read it, in your own account. The run log shows counts and ids, never the text. A step cannot call any host but GitHub's own, and never a private address.