GitHub Actions Configuration

July 13, 2026 · View on GitHub

This document describes the secrets used by the Rhiza-provided GitHub Actions workflows (.github/workflows/rhiza_*.yml) and how to configure them.

PAT_TOKEN

Some workflows may need to push changes to files under .github/workflows/. The automatic github.token cannot do that — GitHub rejects such pushes unless the token carries the workflow scope. If you need it, create a Personal Access Token (PAT) with the workflow scope and store it as a repository secret named PAT_TOKEN.

If PAT_TOKEN is not configured, workflows fall back to github.token.

Creating the token

Fine-grained PAT (recommended):

  1. Go to Settings → Developer settings → Fine-grained tokens → Generate new token (https://github.com/settings/personal-access-tokens/new).
  2. Restrict Repository access to the repository (or repositories) using Rhiza.
  3. Under Repository permissions, grant:
    • Contents: Read and write
    • Workflows: Read and write
    • Pull requests: Read and write (needed for the scheduled sync-PR mode)
  4. Generate the token and copy it.

Classic PAT (alternative):

  1. Go to Settings → Developer settings → Tokens (classic) → Generate new token.
  2. Select the repo and workflow scopes.
  3. Generate the token and copy it.

Storing the secret

In the repository that consumes Rhiza:

  1. Go to Settings → Secrets and variables → Actions → New repository secret.
  2. Name: PAT_TOKEN
  3. Value: the token created above.

Or with the GitHub CLI:

gh secret set PAT_TOKEN

A PAT expires; when sync pushes start failing with a refusing to allow ... workflow error, regenerate the token and update the secret.

Release workflow secrets (optional)

The release workflow (.github/workflows/rhiza_release.yml) supports additional secrets, all optional depending on which release features you use:

SecretPurpose
PYPI_TOKENPublish the built package to PyPI. Not needed when using trusted publishing (OIDC).
GH_PATGit authentication for installing private dependencies during the release build.
UV_EXTRA_INDEX_URLExtra package index URL (with credentials) for private dependencies.

GITHUB_TOKEN is provided automatically by GitHub Actions and needs no configuration.