Github Actions Api

GitHub Actions API is the programmatic interface to the world's most widely used CI/CD platform. For agents: workflow_dispatch events trigger workflows on-demand with custom inputs, run status queries monitor build progress, artifact download retrieves build outputs, and secret management automates credential rotation. GitHub Apps (not PATs) are the recommended auth pattern for production automation — fine-grained permissions and no user dependency. Tight integration with the GitHub ecosystem (issues, PRs, releases). Confidence is docs-derived.

REST API at api.github.com/repos/{owner}/{repo}/actions. Workflow dispatch: POST /actions/workflows/{workflow_id}/dispatches triggers workflow ({ref: "main", inputs: {deploy_env: "staging"}}). List runs: GET /actions/runs (filter by branch, event, status, actor). GET /actions/runs/{run_id} retrieves run details (status, conclusion, duration). GET /actions/runs/{run_id}/logs downloads log archive. POST /actions/runs/{run_id}/cancel cancels running workflow. GET /actions/runs/{run_id}/artifacts lists artifacts. GET /actions/artifacts/{artifact_id}/zip downloads artifact. Secrets: GET /actions/secrets lists repo secrets. PUT /actions/secrets/{name} creates/updates secret (encrypted with repo public key). Variables: GET /actions/variables lists variables; PUT /actions/variables/{name} creates/updates. Runners: GET /actions/runners lists self-hosted runners.

PAT auth: Authorization: Bearer {token}. Tokens from GitHub Settings → Developer Settings → Personal Access Tokens (classic or fine-grained). Required scopes: repo (for private repos), actions:write (for triggers), secrets:write (for secret management). GitHub App (recommended for production): JWT-based installation token with fine-grained repo-level permissions. HTTPS enforced. Rate limiting: 5000 req/hour authenticated (GitHub App: 15,000 req/hour for installations). Workflow secrets: encrypted at rest with NaCl sealed box — use repo public key to encrypt before PUT.

Standard HTTP status codes with JSON error bodies ({message, documentation_url}). 404 for missing workflow file or repo. Workflow dispatch: only works for workflows with workflow_dispatch trigger defined. 422 for inputs not matching workflow_dispatch.inputs schema. Run status: queued → in_progress → completed (conclusion: success/failure/cancelled). Log expiry: workflow run logs kept 90 days by default. Artifact expiry: configurable (default 90 days). GitHub uptime at githubstatus.com. Secondary rate limits: concurrent request limits — implement backoff on 403 secondary rate limit responses.

docs.github.com/en/rest/actions covers workflow triggers, run management, artifact access, secret management, and runner documentation. Getting started: existing GitHub account, create PAT with actions scope — first workflow dispatch in under 5 minutes. Octokit SDK (JS): npm install @octokit/rest. PyGithub (Python): pip install PyGithub. Community via GitHub Community and Stack Overflow (github-actions tag). Exceptional documentation quality — GitHub API docs are among the best in the industry.