GitHub Action for creating a GitHub App installation access token.
In order to use this action, you need to:
- Register new GitHub App
- Store the App's ID in your repository environment variables (example:
APP_ID) - Store the App's private key in your repository secrets (example:
PRIVATE_KEY)
Important
An installation access token expires after 1 hour. Please see this comment for alternative approaches if you have long-running processes.
name: Run tests on staging on: push: branches: - main jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} - uses: ./actions/staging-tests with: token: ${{ steps.app-token.outputs.token }}on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: # required app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} - uses: actions/checkout@v4 with: token: ${{ steps.app-token.outputs.token }} ref: ${{ github.head_ref }} # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config persist-credentials: false - uses: creyD/prettier_action@v4.3 with: github_token: ${{ steps.app-token.outputs.token }}on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: # required app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} - id: committer run: echo "string=${{steps.app-auth.outputs.app-slug}}[bot] <${{ steps.app-auth.outputs.installation-id }}+${{ steps.app-auth.outputs.app-slug }}[bot]@users.noreply.github.com>" >> "$GITHUB_OUTPUT" - run: echo "committer string is ${{steps.committer.outputs.string}}"on: [workflow_dispatch] jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} owner: ${{ github.repository_owner }} - uses: peter-evans/create-or-update-comment@v3 with: token: ${{ steps.app-token.outputs.token }} issue-number: ${{ github.event.issue.number }} body: "Hello, World!"on: [issues] jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: "repo1,repo2" - uses: peter-evans/create-or-update-comment@v3 with: token: ${{ steps.app-token.outputs.token }} issue-number: ${{ github.event.issue.number }} body: "Hello, World!"on: [issues] jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} owner: another-owner - uses: peter-evans/create-or-update-comment@v3 with: token: ${{ steps.app-token.outputs.token }} issue-number: ${{ github.event.issue.number }} body: "Hello, World!"You can use a matrix strategy to create tokens for multiple user or organization accounts.
Note
See this documentation for information on using multiline strings in workflows.
on: [workflow_dispatch] jobs: set-matrix: runs-on: ubuntu-latest outputs: matrix: ${{steps.set.outputs.matrix }} steps: - id: set run: echo 'matrix=[{"owner":"owner1"},{"owner":"owner2","repos":["repo1"]}]' >>"$GITHUB_OUTPUT" use-matrix: name: "@${{ matrix.owners-and-repos.owner }} installation" needs: [set-matrix] runs-on: ubuntu-latest strategy: matrix: owners-and-repos: ${{ fromJson(needs.set-matrix.outputs.matrix) }} steps: - uses: actions/create-github-app-token@v1 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} owner: ${{ matrix.owners-and-repos.owner }} repositories: ${{ join(matrix.owners-and-repos.repos) }} - uses: octokit/request-action@v2.x id: get-installation-repositories with: route: GET /installation/repositories env: GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} - run: echo "$MULTILINE_JSON_STRING" env: MULTILINE_JSON_STRING: ${{ steps.get-installation-repositories.outputs.data }}on: [push] jobs: create_issue: runs-on: self-hosted steps: - name: Create GitHub App token id: create_token uses: actions/create-github-app-token@v1 with: app-id: ${{ vars.GHES_APP_ID }} private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }} owner: ${{ vars.GHES_INSTALLATION_ORG }} github-api-url: ${{ vars.GITHUB_API_URL }} - name: Create issue uses: octokit/request-action@v2.x with: route: POST /repos/${{ github.repository }}/issues title: "New issue from workflow" body: "This is a new issue created from a GitHub Action workflow." env: GITHUB_TOKEN: ${{ steps.create_token.outputs.token }}Required: GitHub App ID.
Required: GitHub App private key. Escaped newlines (\\n) will be automatically replaced with actual newlines.
Optional: The owner of the GitHub App installation. If empty, defaults to the current repository owner.
Optional: Comma-separated list of repositories to grant access to.
Note
If owner is set and repositories is empty, access will be scoped to all repositories in the provided repository owner's installation. If owner and repositories are empty, access will be scoped to only the current repository.
Optional: If truthy, the token will not be revoked when the current job is complete.
Optional: The URL of the GitHub REST API. Defaults to the URL of the GitHub Rest API where the workflow is run from.
GitHub App installation access token.
GitHub App installation ID.
GitHub App slug.
The action creates an installation access token using the POST /app/installations/{installation_id}/access_tokens endpoint. By default,
- The token is scoped to the current repository or
repositoriesif set. - The token inherits all the installation's permissions.
- The token is set as output
tokenwhich can be used in subsequent steps. - Unless the
skip-token-revokeinput is set to a truthy value, the token is revoked in thepoststep of the action, which means it cannot be passed to another job. - The token is masked, it cannot be logged accidentally.
Note
Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.