Unable to Access Environment Variable in GitHub Action Workflow

[frottke]

Select Topic Area

Question

Body

Hello :)

I'm encountering an issue in my workflow/action when trying to retrieve the value of an environment variable. The gh api request works perfectly on my local machine, but when executed within the workflow, I receive the following error:

gh: Resource not accessible by integration (HTTP 403)

My Workflow Step:

  get-variable:
    runs-on: ubuntu-latest
    steps:
      - name: Get Variable
        run: |
            gh api -X GET /repos/MyRepo/environments/MyEnv/variables/MyVariable --template '{{.value}}'   

Troubleshooting Attempts:
I tried modifying the step to the following, which works but does not achieve my intended goal:

  get-variable:
    runs-on: ubuntu-latest
    steps:
      - name: Get Variable
        run: |
            gh api -X GET /repos/MyRepo/environments/MyEnv 

It appears that the GH_TOKEN does not have access to the required resources. I have already tried setting the permissions to write-all and configured all the necessary settings in the repository.

edit: / added informations: I know that I can use environment: my_environment but I want to get the variable from an other environment without triggering an "deployment"

[mickeygousset]

Have you tried using ${{env.YOURVARIABLENAME}} to get the environment variable?

[frottke]

no , because there is no environment assigned to step. As it should be, because the steps is not an deployment :/

just wanted to add the following: I just found an github action that does something to my coding and there is mentioned that an own PAT is needed for some reason. I'll try it
https://github.com/raven-actions/environment-variables?tab=readme-ov-file#prerequisites-permissions

[frottke]

Unfortunately, this does not work because the authentication is "lower level" as the workflow itself has already logged in with this credentials. I have now found a text here which describes this a little. I'll give it a try

[frottke]

followup:

I got it working but only with an own PAT. GITHUB_TOKEN is not sufficient not even with permissions: write-all aka those permissions:

GITHUB_TOKEN Permissions
  Actions: write
  Attestations: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write