Skip to main content
emisar

Grafana

v0.1.20

Grafana admin-API ops — datasource health, dashboard listings, alert state, user list, version, settings. Read-only. Auth via a bearer token or Basic credentials on the runner host.

9 allowed by default 1 need approval by default
Pack ID
grafana
Vendor
emisar
OS
linux
Actions
10
Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.
curl jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host 
sudo emisar pack install grafana --hash sha256:82c1ced1e1661dfd58dc5027ebbd9e3315a8b7f76a2e92a0d708b0a60175b868

Setup

Every action calls the Grafana HTTP API at $GRAFANA_URL via curl. Set $GRAFANA_TOKEN for bearer authentication, or $GRAFANA_USER and $GRAFANA_PASSWORD for Basic authentication. Basic credentials are required for server-admin endpoints such as orgs and settings.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • GRAFANA_URL default http://127.0.0.1:3000

    Grafana base URL (scheme + host + port, no trailing path). Defaults to a local Grafana.

  • GRAFANA_TOKEN

    Service-account token or API key sent as the Bearer credential.

  • GRAFANA_USER

    Grafana user for Basic authentication. Takes precedence over GRAFANA_TOKEN .

  • GRAFANA_PASSWORD

    Password paired with GRAFANA_USER .

Notes

  • Any Grafana env var you set must also be allowlisted in the runner's execution.inherit_env — the action env is scrubbed to PATH/LANG/LC_ALL/TERM by default, so an env present on the host but not allowlisted is silently dropped (the action falls back to its local default or fails auth).
  • Create the token as a service account (Administration -> Service accounts) or a legacy API key; this pack is read-only, so a Viewer/Admin-read role is enough.
  • Server-admin endpoints do not accept service-account tokens; use a Grafana server-admin user's Basic credentials for orgs and settings.

Verify it works

Runs grafana.health, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify grafana

Install and configure a pack walks through the whole sequence on a host.

Actions 10 total

View on GitHub
  • grafana.alerting_rules script low Low: read-only or trivially reversible

    List Grafana-managed rules

    List all accessible Grafana-managed alerting and recording rules with group, identity, labels, pause state, evaluation health and totals. Omit queries, annotations, alert instances and notification settings. Return the complete projection within a 256 KiB budget or fail without partial data.

    View source on GitHub
  • grafana.alerting_state script low Low: read-only or trivially reversible

    GET /api/alertmanager/grafana/api/v2/alerts

    List currently-firing alerts known to Grafana's alertmanager.

    View source on GitHub
  • grafana.dashboards_search script low Low: read-only or trivially reversible

    GET /api/search

    Search dashboards (default returns all dashboards).

    View source on GitHub
  • grafana.datasource_health script low Low: read-only or trivially reversible

    GET /api/datasources/uid/<uid>/health

    Check health of one datasource (tests connectivity).

    View source on GitHub
  • grafana.datasources script low Low: read-only or trivially reversible

    GET /api/datasources

    List all datasources with type, URL, access mode, and which one is the default. The URL's basic-auth userinfo is cut and the plugin-authored jsonData object is reduced to its key names, so a credential the operator configured into either one stays on the host.

    View source on GitHub
  • grafana.health script low Low: read-only or trivially reversible

    GET /api/health

    Show liveness + DB-ok state.

    View source on GitHub
  • grafana.orgs script low Low: read-only or trivially reversible

    GET /api/orgs

    List all orgs (multi-tenant view). Requires a Grafana server-admin token; an org-admin token gets 403 here (use grafana.users for the current org).

    View source on GitHub
  • grafana.settings script high High: can disrupt service

    GET /api/admin/settings

    Show server settings (auth, smtp, database paths). Requires a Grafana server-admin token; an org-admin token gets 403 here. Grafana masks the credentials it recognizes and returns the rest as configured, so treat the response as secret-bearing.

    View source on GitHub
  • grafana.users script low Low: read-only or trivially reversible

    GET /api/org/users (org admin)

    List all users in the current org. Requires an Admin-scoped token.

    View source on GitHub
  • grafana.version script low Low: read-only or trivially reversible

    Show Grafana build and license information

    Show build version, commit, edition and environment, plus license expiry, edition and state. Omit frontend settings, plugins, datasources and analytics fields. Fail on invalid JSON or a projection exceeding 8 KiB.

    View source on GitHub
← Back to registry
Pack reference  Publish your own