GitHub

Declaratively manage GitHub repositories, teams, secrets and other GitHub resources from Bicep.

Community Maintained

Version	0.0.1
Artifact	br:ghcr.io/anthony-c-martin/bicep-ext-github:0.0.1
Source	github.com/anthony-c-martin/bicep-ext-github
Publisher	anthony-c-martin
Licence	MIT
Category	DevOps

Installation

Register the extension in bicepconfig.json:

{
  "experimentalFeaturesEnabled": {
    "localDeploy": true,
    "ociEnabled": true
  },
  "implicitExtensions": [],
  "extensions": {
    "github": "br:ghcr.io/anthony-c-martin/bicep-ext-github:0.0.1"
  }
}

Then reference it from your Bicep file:

extension github

Configuration

Configuration is supplied using extension github with { ... }.

Property	Type	Attributes	Description
token	string	Required, Sensitive	The GitHub personal access token with the required permissions

Authentication

The extension authenticates with a GitHub personal access token, supplied through the extension configuration:

extension github with {
  token: gitHubToken
}

Keep the token out of source control by declaring it as a secure parameter and supplying it at deployment time:

main.bicep

@secure()
param gitHubToken string

extension github with {
  token: gitHubToken
}

main.bicepparam

using 'main.bicep'

param gitHubToken = readEnvironmentVariable('GITHUB_TOKEN')

The token needs scopes appropriate to the resources you manage — repo for repository resources, and admin:org for organisation-level resources such as OrganizationActionsSecret.

Example

Create a repository, protect its default branch, and add a secret used by Actions:

targetScope = 'local'

@secure()
param gitHubToken string

extension github with {
  token: gitHubToken
}

resource repo 'Repository' = {
  owner: 'contoso'
  name: 'hello-world'
  description: 'Managed with Bicep'
  visibility: 'Public'
  deleteBranchOnMerge: true
}

resource protection 'BranchProtectionRule' = {
  owner: repo.owner
  repository: repo.name
  pattern: 'main'
}

resource secret 'ActionsSecret' = {
  owner: repo.owner
  repository: repo.name
  name: 'API_KEY'
  value: 'super-secret'
}

Notes

• Resources are identified by their natural GitHub keys — an owner and name pair for repositories, for example — rather than by a generated ID.
• Deleting a Repository resource deletes the repository itself. Remove the resource from your template with care.

Samples

2 example Bicep files are available under Samples.

Resource types

This extension exposes 21 resource types, documented under Reference.

Reference generated from ghcr.io/anthony-c-martin/bicep-ext-github:0.0.1 on 2026-08-23.