would it be possible/reasonable to have this as yaml which it then turned into json before sending it to the GH api? it would be more consistent with the representation we use in the workflow files

@simoneb I may have missed something, but AFAICT the input values should always be a string.

The action.yml documentation is a bit vague, yet assumes the values can be converted to environment variables:

Optional Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.

Also, the default input value of the first example provided by this doc, despite being a number, is quoted as a string:

inputs:
  numOctocats:
    description: 'Number of Octocats'
    required: false
    default: '1'
  octocatEyeColor:
    description: 'Eye color of the Octocats'
    required: true

Also, actions on the marketplace that need a more complex structure are often referring a file path (e.g to a JSON or YAML ) instead

fair enough

Since this input is not required, what happens if it is not specified?

fair point, without tests it's hard to say but I suspect this may break. maybe the default value of this input should be something that parses to null or another sensible default

Fair point:

permissionsJSON comes from getInput.

If the value is not provided, then permissionsJSON is the empty string according to the doc, and unfortunately JSON.parse('') throws. So it needs a small update.

This case should now properly be handled :)