Is it possible to get an actor specific token or set the actor in a deployment when calling from the API?

[humphreyja]

Select Topic Area

Question

Body

When using a GitHub custom JS action, making a call to something like createDeployment doesn't allow you to set the actor. If for example the action is manually triggered or triggered from a merge, it'd be nice to show on the deployments dashboard who triggered that deployment. But the API doesn't allow you to set that. I assume it is based off the token given to the API. But doing so just shows that the deployment was created by gh-actions.

Any suggestions?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[harish-govindasamy]

Hi @humphreyja,

You’re right — the GitHub API for creating deployments uses the token’s identity, so the actor is implicitly the token owner (often gh-actions for workflow tokens). Unfortunately, there’s no way to explicitly set or impersonate another actor when calling the deployment API.

If you want the deployment dashboard to show who triggered the deployment, a common workaround is to:

• Use a personal access token (PAT) or a GitHub App token tied to the actual user, rather than the default GITHUB_TOKEN.
• In your workflow, pass the triggering user’s identity (e.g., github.actor) and use a token with appropriate permissions to call createDeployment. This way, the deployment is recorded as created by the user owning that token.

However, this requires securely managing tokens and possibly user-specific tokens, which can be complex.

So in short, there is no built-in way to “set” or override the actor in the deployment API call. The actor is always the token’s identity.

Hope this helps! Let me know if you want some examples or best practices around token usage for this.

[JavMB]

Hey!

Unfortunately, you can't directly set a custom actor when using the GitHub API for deployments. The actor is indeed tied to the token being used, and with GITHUB_TOKEN it will always show as "github-actions".

However, there are a few workarounds:

Option 1: Use the deployment description/environment

await github.rest.repos.createDeployment({
  owner: context.repo.owner,
  repo: context.repo.repo,
  ref: context.sha,
  environment: 'production',
  description: `Deployed by ${context.actor}` // This shows who triggered it
});

Option 2: Personal Access Token (not recommended for actions) If you use a PAT instead of GITHUB_TOKEN, it would show that user as the actor, but this breaks the security model of Actions.

Option 3: Custom deployment status with actor info

await github.rest.repos.createDeploymentStatus({
  owner: context.repo.owner,
  repo: context.repo.repo,
  deployment_id: deployment.data.id,
  state: 'success',
  description: `Successfully deployed by ${context.actor}`
});

The GitHub API intentionally doesn't allow actor spoofing for security reasons. Your best bet is using the description field to track who initiated the deployment.

Hope this helps!

[AlexanderGese]

🧩 GitHub Actions: Custom Deployment Shows "github-actions" Instead of Actual Actor

When using a custom JavaScript GitHub Action to call the REST API (e.g. createDeployment), it always shows the actor as github-actions on the Deployments dashboard. This is because the actor is tied to the token used for authentication — not something you can set manually in the API.

---

🤔 Why Can’t I Set the Actor?

GitHub’s API does not allow setting the actor field manually when creating deployments. It’s automatically derived from the GITHUB_TOKEN or any personal access token (PAT) used in the request.

If you use the built-in GITHUB_TOKEN, the actor will always be github-actions.

---

✅ Workarounds / Suggestions

1. Use a Personal Access Token (PAT)

Instead of the default GITHUB_TOKEN, use a fine-scoped PAT that belongs to a real user. This way, the actor shown will be the user who owns the token.

env:
  GH_TOKEN: ${{ secrets.DEPLOYER_PAT }}

steps:
  - name: Create deployment
    run: |
      curl -X POST \
        -H "Authorization: Bearer $GH_TOKEN" \
        -H "Accept: application/vnd.github+json" \
        https://api.github.com/repos/${{ github.repository }}/deployments \
        -d '{ "ref": "main", "required_contexts": [], "environment": "production" }'

🛑 Make sure to store the PAT securely and restrict its scope (e.g. repo + deployment permissions only).

2. Log the Triggering Actor Manually

As a workaround, log the actual triggering user manually using github.actor and include it in the deployment payload or logs:

const actor = process.env.GITHUB_ACTOR;
console.log(`Triggered by: ${actor}`);

You could also tag the deployment or include the actor name in the description or payload:

description: `Deployment triggered by ${actor}`

3. Use GitHub’s [actions/deployments](https://github.com/actions/deployments) Action

If possible, switch to using actions/deployments. It's more integrated with GitHub UI and might handle some metadata better, although it still won’t fully solve the actor limitation with GITHUB_TOKEN.

---

🧵 TL;DR

• createDeployment does not let you set the actor.
• The actor is tied to the token used.
• Use a PAT to impersonate a real user.
• Optionally log github.actor in the deployment metadata for visibility.