Is there a command to list the permissions my current token has?

[airtonix]

trying to workout what permissions a token we have listed in our CI currently has access to

[mjpieters]

I don't think that this is something a gh command could ever tell you, because there is, as far as I can make out, no GitHub REST API endpoint or GraphQL object that provides this information. Without API support, the command tool can't tell you either.

[mislav]

@airtonix If your token is a PAT (classic) or an OAuth token, then you can do gh api -i user and observe the X-Oauth-Scopes response header.

If your token is a fine-grained PAT (beta) or an Actions-generated GITHUB_TOKEN, then I do not know of a way to inspect the permissions that a token has. There might not be any, like @mjpieters points out.

[mjpieters]

Interesting, I didn't think of response headers there.

So, as an example:

$ bin/gh api -i user | grep X-Oauth-Scopes | cut -c17-
admin:public_key, admin:repo_hook, delete_repo, gist, read:org, repo

Someone should try that with an actions GITHUB_TOKEN value or a fine-grained PAT, just to see what happens in those cases.

[mislav]

@mjpieters In those cases, there will be no X-Oauth-Scopes response header, because those tokens do not have a concept of "scopes".

[airtonix]

You can see how useful this is for long running projects that overlap the tenure of team members.