Read-only GitHub Actions, Variables, and Environments permissions

To improve GitHub Actions migration support, the Buildkite GitHub App now requests read-only access to Actions, Variables, and Environments.

These permissions let Buildkite inspect configuration that affects how workflows and deployments run—including configuration variables referenced through ${{ vars.* }}, secret names (not secret values), deployment protection rules, and deployment branch policies—so migrated pipelines can preserve existing behavior and safeguards. All three permissions are read-only; Buildkite will not modify Actions workflows, variables, or environments. The Actions permission also permits reading workflow run logs; Buildkite requests it for migration and configuration compatibility.

Existing installations keep their current permissions until a GitHub organization owner approves the request. New installations request the current permission set when installed.