Authorizing in GitHub Actions

[satoved]

I'm writing a GitHub Action to post a changelog to Basecamp on the merge to main.

The action would have Basecamp CLI and skill as dependencies, along with Claude.

Cannot find an option to authorize Basecamp for the Action via Auth2.0.

I can probably give it a token via (which would expire). And action cannot open a browser to get access.

Is there a way to get a constant token? Or am I missing something?

[Rexy40407]

GitHub Actions cannot complete an interactive OAuth flow, so the login should happen once outside the runner and the resulting credential should be supplied as an encrypted Actions secret.

The Basecamp CLI exposes basecamp auth token specifically for scripts. A typical setup is:

1. Run basecamp auth login locally.
2. Run basecamp auth token and copy the output without committing it.
3. Add it as a repository secret, for example BASECAMP_TOKEN.
4. Pass the secret to the job as an environment variable (or to whatever token input the CLI/action exposes):

- name: Install Basecamp CLI
  run: curl -fsSL https://basecamp.com/install-cli | bash

- name: Publish changelog
  env:
    BASECAMP_TOKEN: ${{ secrets.BASECAMP_TOKEN }}
  run: basecamp --help

If the CLI version you use only reads its OAuth config/credential file and not BASECAMP_TOKEN, store the CLI credential/refresh-token material as an encrypted secret and restore it into the runner before invoking the command, or use a dedicated OAuth app/service account. Do not put the token in YAML, logs, or the repository.

One caveat: an OAuth access token can expire. For long-lived automation, make sure the refresh token is persisted securely or use a supported static/service token and rotate it when required.