Account
Permissions and security
What the GitHub App’s permissions allow, which calls Cronkick makes, what it stores, and how to stop it.
Permissions
You install Cronkick on the repositories you choose. In those repositories it asks for:
| Actions | Read and write |
|---|---|
| Contents | Read |
| Metadata | Read (every GitHub App gets it) |
Cronkick uses GitHub App tokens that GitHub issues for one hour at a time. You never need a personal access token.
What these permissions allow
GitHub grants each permission as a whole, not only the parts Cronkick uses. In the repositories you select:
| Contents: read | Read any file, commit, branch and release, and download the code as an archive. |
|---|---|
| Actions: read | Read workflows, runs, jobs, logs and artifacts. |
| Actions: write | Start any workflow that has a workflow_dispatch: trigger, on any branch or tag, with any values for its inputs; that run gets the workflow’s secrets and its GITHUB_TOKEN. Also cancel, re-run and delete runs, delete logs, artifacts and caches, approve runs from outside contributors’ pull requests, enable or disable workflows, and change the repository’s OIDC subject claim settings. |
Neither permission lets the app read secret values (GitHub puts those under a separate Secrets permission, which Cronkick doesn’t ask for), push commits or change files. A workflow the app starts still runs with its own secrets and permissions.
If Cronkick’s app key were stolen, someone could do what the table above allows in the repositories you selected, including starting any deploy or release workflow that has workflow_dispatch:, with its secrets, on any branch or tag. Selecting only the repositories that need schedules keeps that small.
What Cronkick calls
With the access you grant, Cronkick makes only these calls, plus GitHub’s installation-token exchange (POST /app/installations/…/access_tokens), which turns the app’s key into the one-hour token:
GET /app/installations | List the accounts the app is installed on (a daily check). |
|---|---|
GET /installation/repositories | List the repositories you selected. |
GET /repos/…/actions/workflows | List the workflows in a repository. |
GET /repos/…/contents/… | Read a workflow file to find markers. |
POST /repos/…/actions/workflows/…/dispatches | Start a workflow at its scheduled time. |
GET /repos/…/actions/workflows/…/runs | For a workflow still on GitHub’s own schedule, list the runs GitHub’s scheduler started, to show you how it ran. |
Run results come to Cronkick from GitHub’s push and workflow_run webhooks. The runs list above is read once an hour, and only for workflows still on GitHub’s schedule, to confirm what those webhooks said.
Two other kinds of call don’t use the app’s access to your repositories:
- Sign-in. GitHub’s sign-in gives Cronkick a token for you. It calls
GET /userandGET /user/installationsto see which accounts you can open, then discards the token. - The lateness probe. Cronkick reads the scheduled runs of its own probe repositories (
GET /repos/…/actions/runs) with a separate token, to measure GitHub’s scheduler. It never reads yours this way.
What Cronkick doesn’t do
Cronkick doesn’t read secret values, push commits or edit workflow files. It only starts workflows you marked. Those workflows run with their own secrets and permissions, exactly as they would on GitHub’s schedule, so whatever a workflow can do when it runs, it can still do when Cronkick starts it.
What we store, and where
Repository and workflow names, the # cronkick lines Cronkick reads (and the crons of a leftover schedule: block, to suggest the switch), compatibility warnings, and the history of each scheduled run. A warning can name a workflow input or give a YAML parser’s error message with its line number; it never copies the file’s lines. We don’t store your code, the rest of your workflow files, or your workflow logs. Data lives on DigitalOcean in the United States. Details and every company that processes data for us are in the privacy policy. Who runs Cronkick is on the about page.
Stopping and revoking
Remove a marker line to stop one schedule. To revoke access, uninstall the GitHub App, or remove repositories from it, under GitHub Apps in your account or organization settings; nothing is triggered after that. To move workflows back first, see Go back to GitHub’s scheduler.
Reporting a security issue
Email [email protected]. The same address is in /.well-known/security.txt.