build(release): 1.11.0 [skip ci]

# [1.11.0](https://github.com/actions/create-github-app-token/compare/v1.10.4...v1.11.0) (2024-09-11) ### Features * allow repositories input to be comma or newline-separated ([#169](https://github.com/actions/create-github-app-token/issues/169)) ([796b88d](https://github.com/actions/create-github-app-token/commit/796b88dc585016182c9da7fa3e5dfe98e0a9b19f))
feat: allow repositories input to be comma or newline-separated (#169 )
2024-09-11 20:55:26 +00:00 · 2024-09-11 13:54:50 -07:00 · 2024-09-04 04:41:08 +00:00 · 2024-09-03 21:40:32 -07:00 · 2024-09-03 21:39:02 -07:00 · 2024-09-03 20:04:47 -07:00
21 changed files with 1347 additions and 813 deletions
@@ -5,6 +5,7 @@ on:
    branches:
      - main
  pull_request:
+  workflow_dispatch:

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -12,6 +12,9 @@ In order to use this action, you need to:
 2. [Store the App's ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`)
 3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`)

+> [!IMPORTANT]  
+> An installation access token expires after 1 hour. Please [see this comment](https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796) for alternative approaches if you have long-running processes.
+
 ### Create a token for the current repository

 ```yaml
@@ -61,6 +64,68 @@ jobs:
          github_token: ${{ steps.app-token.outputs.token }}
 ```

+### Create a git committer string for an app installation
+
+```yaml
+on: [pull_request]
+
+jobs:
+  auto-format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          # required
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+      - name: Get GitHub App User ID
+        id: get-user-id
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      - id: committer
+        run: echo "string=${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"  >> "$GITHUB_OUTPUT"
+      - run: echo "committer string is ${ {steps.committer.outputs.string }}"
+```
+
+### Configure git CLI for an app's bot user
+
+```yaml
+on: [pull_request]
+
+jobs:
+  auto-format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          # required
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+      - name: Get GitHub App User ID
+        id: get-user-id
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      - run: |
+          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
+          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>'
+      # git commands like commit work using the bot user
+      - run: |
+          git add .
+          git commit -m "Auto-generated changes"
+          git push
+```
+
+> [!TIP]
+> The `<BOT USER ID>` is the numeric user ID of the app's bot user, which can be found under `https://api.github.com/users/<app-slug>%5Bbot%5D`.
+> 
+> For example, we can check at `https://api.github.com/users/dependabot[bot]` to see the user ID of Dependabot is 49699333.
+>
+> Alternatively, you can use the [octokit/request-action](https://github.com/octokit/request-action) to get the ID.
+
 ### Create a token for all repositories in the current owner's installation

 ```yaml
@@ -98,7 +163,9 @@ jobs:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
-          repositories: "repo1,repo2"
+          repositories: |
+            repo1
+            repo2
      - uses: peter-evans/create-or-update-comment@v3
        with:
          token: ${{ steps.app-token.outputs.token }}
@@ -142,7 +209,7 @@ jobs:
  set-matrix:
    runs-on: ubuntu-latest
    outputs:
-      matrix: ${{steps.set.outputs.matrix }}
+      matrix: ${{ steps.set.outputs.matrix }}
    steps:
      - id: set
        run: echo 'matrix=[{"owner":"owner1"},{"owner":"owner2","repos":["repo1"]}]' >>"$GITHUB_OUTPUT"
@@ -213,13 +280,31 @@ jobs:

 **Required:** GitHub App private key. Escaped newlines (`\\n`) will be automatically replaced with actual newlines.

+Some other actions may require the private key to be Base64 encoded. To avoid recreating a new secret, it can be decoded on the fly, but it needs to be managed securely. Here is an example of how this can be achieved:
+
+```yaml
+steps:
+  - name: Decode the GitHub App Private Key
+    id: decode
+    run: |
+      private_key=$(echo "${{ secrets.PRIVATE_KEY }}" | base64 -d | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
+      echo "::add-mask::$private_key"
+      echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
+  - name: Generate GitHub App Token
+    id: app-token
+    uses: actions/create-github-app-token@v1
+    with:
+      app-id: ${{ vars.APP_ID }}
+      private-key: ${{ steps.decode.outputs.private-key }}
+```
+
 ### `owner`

 **Optional:** The owner of the GitHub App installation. If empty, defaults to the current repository owner.

 ### `repositories`

-**Optional:** Comma-separated list of repositories to grant access to.
+**Optional:** Comma or newline-separated list of repositories to grant access to.

 > [!NOTE]
 > If `owner` is set and `repositories` is empty, access will be scoped to all repositories in the provided repository owner's installation. If `owner` and `repositories` are empty, access will be scoped to only the current repository.
@@ -23,7 +23,7 @@ inputs:
    description: "The owner of the GitHub App installation (defaults to current repository owner)"
    required: false
  repositories:
-    description: "Repositories to install the GitHub App on (defaults to current repository if owner is unset)"
+    description: "Comma or newline-separated list of repositories to install the GitHub App on (defaults to current repository if owner is unset)"
    required: false
  skip-token-revoke:
    description: "If truthy, the token will not be revoked when the current job is complete"
@@ -2238,6 +2238,7 @@ var require_decodeText = __commonJS({
            return decoders.utf8;
          case "latin1":
          case "ascii":
+          // TODO: Make these a separate, strict decoder?
          case "us-ascii":
          case "iso-8859-1":
          case "iso8859-1":
@@ -2937,6 +2938,7 @@ var require_basename = __commonJS({
      for (var i = path.length - 1; i >= 0; --i) {
        switch (path.charCodeAt(i)) {
          case 47:
+          // '/'
          case 92:
            path = path.slice(i + 1);
            return path === ".." || path === "." ? "" : path;
@@ -4171,7 +4173,21 @@ var require_util2 = __commonJS({
          return referrerOrigin;
        }
        case "strict-origin":
+        // eslint-disable-line
+        /**
+           * 1. If referrerURL is a potentially trustworthy URL and
+           * request’s current URL is not a potentially trustworthy URL,
+           * then return no referrer.
+           * 2. Return referrerOrigin
+          */
        case "no-referrer-when-downgrade":
+        // eslint-disable-line
+        /**
+         * 1. If referrerURL is a potentially trustworthy URL and
+         * request’s current URL is not a potentially trustworthy URL,
+         * then return no referrer.
+         * 2. Return referrerOrigin
+        */
        default:
          return isNonPotentiallyTrustWorthy ? "no-referrer" : referrerOrigin;
      }
@@ -19943,6 +19959,27 @@ var require_util8 = __commonJS({
    }
    var kEnumerableProperty = /* @__PURE__ */ Object.create(null);
    kEnumerableProperty.enumerable = true;
+    var normalizedMethodRecordsBase = {
+      delete: "DELETE",
+      DELETE: "DELETE",
+      get: "GET",
+      GET: "GET",
+      head: "HEAD",
+      HEAD: "HEAD",
+      options: "OPTIONS",
+      OPTIONS: "OPTIONS",
+      post: "POST",
+      POST: "POST",
+      put: "PUT",
+      PUT: "PUT"
+    };
+    var normalizedMethodRecords = {
+      ...normalizedMethodRecordsBase,
+      patch: "patch",
+      PATCH: "PATCH"
+    };
+    Object.setPrototypeOf(normalizedMethodRecordsBase, null);
+    Object.setPrototypeOf(normalizedMethodRecords, null);
    module2.exports = {
      kEnumerableProperty,
      nop,
@@ -19981,6 +20018,8 @@ var require_util8 = __commonJS({
      isValidHeaderValue,
      isTokenCharCode,
      parseRangeHeader,
+      normalizedMethodRecordsBase,
+      normalizedMethodRecords,
      isValidPort,
      isHttpOrHttpsPrefixed,
      nodeMajor,
@@ -20196,7 +20235,8 @@ var require_request3 = __commonJS({
      isBlobLike,
      buildURL,
      validateHandler,
-      getServerName
+      getServerName,
+      normalizedMethodRecords
    } = require_util8();
    var { channels } = require_diagnostics();
    var { headerNameLowerCasedRecord } = require_constants6();
@@ -20223,12 +20263,12 @@ var require_request3 = __commonJS({
          throw new InvalidArgumentError("path must be a string");
        } else if (path[0] !== "/" && !(path.startsWith("http://") || path.startsWith("https://")) && method !== "CONNECT") {
          throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.exec(path) !== null) {
+        } else if (invalidPathRegex.test(path)) {
          throw new InvalidArgumentError("invalid request path");
        }
        if (typeof method !== "string") {
          throw new InvalidArgumentError("method must be a string");
-        } else if (!isValidHTTPToken(method)) {
+        } else if (normalizedMethodRecords[method] === void 0 && !isValidHTTPToken(method)) {
          throw new InvalidArgumentError("invalid request method");
        }
        if (upgrade && typeof upgrade !== "string") {
@@ -20773,7 +20813,7 @@ var require_connect2 = __commonJS({
        }
      };
    }
-    function buildConnector({ allowH2, maxCachedSessions, socketPath, timeout, ...opts }) {
+    function buildConnector({ allowH2, maxCachedSessions, socketPath, timeout, session: customSession, ...opts }) {
      if (maxCachedSessions != null && (!Number.isInteger(maxCachedSessions) || maxCachedSessions < 0)) {
        throw new InvalidArgumentError("maxCachedSessions must be a positive integer or zero");
      }
@@ -20789,7 +20829,7 @@ var require_connect2 = __commonJS({
          }
          servername = servername || options.servername || util.getServerName(host) || null;
          const sessionKey = servername || hostname;
-          const session = sessionCache.get(sessionKey) || null;
+          const session = customSession || sessionCache.get(sessionKey) || null;
          assert(sessionKey);
          socket = tls.connect({
            highWaterMark: 16384,
@@ -22307,7 +22347,7 @@ var require_util9 = __commonJS({
    var { getGlobalOrigin } = require_global3();
    var { collectASequenceOfCodePoints, collectAnHTTPQuotedString, removeChars, parseMIMEType } = require_data_url();
    var { performance: performance2 } = require("node:perf_hooks");
-    var { isBlobLike, ReadableStreamFrom, isValidHTTPToken } = require_util8();
+    var { isBlobLike, ReadableStreamFrom, isValidHTTPToken, normalizedMethodRecordsBase } = require_util8();
    var assert = require("node:assert");
    var { isUint8Array } = require("node:util/types");
    var { webidl } = require_webidl2();
@@ -22414,7 +22454,7 @@ var require_util9 = __commonJS({
    }
    function appendRequestOriginHeader(request2) {
      let serializedOrigin = request2.origin;
-      if (serializedOrigin === "client") {
+      if (serializedOrigin === "client" || serializedOrigin === void 0) {
        return;
      }
      if (request2.responseTainting === "cors" || request2.mode === "websocket") {
@@ -22532,7 +22572,21 @@ var require_util9 = __commonJS({
          return referrerOrigin;
        }
        case "strict-origin":
+        // eslint-disable-line
+        /**
+           * 1. If referrerURL is a potentially trustworthy URL and
+           * request’s current URL is not a potentially trustworthy URL,
+           * then return no referrer.
+           * 2. Return referrerOrigin
+          */
        case "no-referrer-when-downgrade":
+        // eslint-disable-line
+        /**
+         * 1. If referrerURL is a potentially trustworthy URL and
+         * request’s current URL is not a potentially trustworthy URL,
+         * then return no referrer.
+         * 2. Return referrerOrigin
+        */
        default:
          return isNonPotentiallyTrustWorthy ? "no-referrer" : referrerOrigin;
      }
@@ -22695,29 +22749,8 @@ var require_util9 = __commonJS({
    function isCancelled(fetchParams) {
      return fetchParams.controller.state === "aborted" || fetchParams.controller.state === "terminated";
    }
-    var normalizeMethodRecordBase = {
-      delete: "DELETE",
-      DELETE: "DELETE",
-      get: "GET",
-      GET: "GET",
-      head: "HEAD",
-      HEAD: "HEAD",
-      options: "OPTIONS",
-      OPTIONS: "OPTIONS",
-      post: "POST",
-      POST: "POST",
-      put: "PUT",
-      PUT: "PUT"
-    };
-    var normalizeMethodRecord = {
-      ...normalizeMethodRecordBase,
-      patch: "patch",
-      PATCH: "PATCH"
-    };
-    Object.setPrototypeOf(normalizeMethodRecordBase, null);
-    Object.setPrototypeOf(normalizeMethodRecord, null);
    function normalizeMethod(method) {
-      return normalizeMethodRecordBase[method.toLowerCase()] ?? method;
+      return normalizedMethodRecordsBase[method.toLowerCase()] ?? method;
    }
    function serializeJavascriptValueToJSONString(value) {
      const result = JSON.stringify(value);
@@ -22854,7 +22887,7 @@ var require_util9 = __commonJS({
        }
      });
    }
-    async function fullyReadBody(body, processBody, processBodyError, shouldClone) {
+    async function fullyReadBody(body, processBody, processBodyError) {
      const successSteps = processBody;
      const errorSteps = processBodyError;
      let reader;
@@ -22865,7 +22898,7 @@ var require_util9 = __commonJS({
        return;
      }
      try {
-        successSteps(await readAllBytes(reader, shouldClone));
+        successSteps(await readAllBytes(reader));
      } catch (e) {
        errorSteps(e);
      }
@@ -22888,19 +22921,12 @@ var require_util9 = __commonJS({
      assert(!invalidIsomorphicEncodeValueRegex.test(input));
      return input;
    }
-    async function readAllBytes(reader, shouldClone) {
+    async function readAllBytes(reader) {
      const bytes = [];
      let byteLength = 0;
      while (true) {
        const { done, value: chunk } = await reader.read();
        if (done) {
-          if (bytes.length === 1) {
-            const { buffer, byteOffset, byteLength: byteLength2 } = bytes[0];
-            if (shouldClone === false) {
-              return Buffer.from(buffer, byteOffset, byteLength2);
-            }
-            return Buffer.from(buffer.slice(byteOffset, byteOffset + byteLength2), 0, byteLength2);
-          }
          return Buffer.concat(bytes, byteLength);
        }
        if (!isUint8Array(chunk)) {
@@ -23163,7 +23189,6 @@ var require_util9 = __commonJS({
      urlHasHttpsScheme,
      urlIsHttpHttpsScheme,
      readAllBytes,
-      normalizeMethodRecord,
      simpleRangeHeaderValue,
      buildContentRange,
      parseMetadata,
@@ -23663,11 +23688,23 @@ var require_body2 = __commonJS({
    var { webidl } = require_webidl2();
    var { Blob: Blob2 } = require("node:buffer");
    var assert = require("node:assert");
-    var { isErrored } = require_util8();
+    var { isErrored, isDisturbed } = require("node:stream");
    var { isArrayBuffer } = require("node:util/types");
    var { serializeAMimeType } = require_data_url();
    var { multipartFormDataParser } = require_formdata_parser();
    var textEncoder = new TextEncoder();
+    function noop() {
+    }
+    var hasFinalizationRegistry = globalThis.FinalizationRegistry && process.version.indexOf("v18") !== 0;
+    var streamRegistry;
+    if (hasFinalizationRegistry) {
+      streamRegistry = new FinalizationRegistry((weakRef) => {
+        const stream = weakRef.deref();
+        if (stream && !stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
+          stream.cancel("Response object has been garbage collected").catch(noop);
+        }
+      });
+    }
    function extractBody(object, keepalive = false) {
      let stream = null;
      if (object instanceof ReadableStream) {
@@ -23810,8 +23847,11 @@ Content-Type: ${value.type || "application/octet-stream"}\r
      }
      return extractBody(object, keepalive);
    }
-    function cloneBody(body) {
+    function cloneBody(instance, body) {
      const [out1, out2] = body.stream.tee();
+      if (hasFinalizationRegistry) {
+        streamRegistry.register(instance, new WeakRef(out1));
+      }
      body.stream = out1;
      return {
        stream: out2,
@@ -23835,18 +23875,18 @@ Content-Type: ${value.type || "application/octet-stream"}\r
              mimeType = serializeAMimeType(mimeType);
            }
            return new Blob2([bytes], { type: mimeType });
-          }, instance, false);
+          }, instance);
        },
        arrayBuffer() {
          return consumeBody(this, (bytes) => {
-            return bytes.buffer;
-          }, instance, true);
+            return new Uint8Array(bytes).buffer;
+          }, instance);
        },
        text() {
-          return consumeBody(this, utf8DecodeBytes, instance, false);
+          return consumeBody(this, utf8DecodeBytes, instance);
        },
        json() {
-          return consumeBody(this, parseJSONFromBytes, instance, false);
+          return consumeBody(this, parseJSONFromBytes, instance);
        },
        formData() {
          return consumeBody(this, (value) => {
@@ -23875,12 +23915,12 @@ Content-Type: ${value.type || "application/octet-stream"}\r
            throw new TypeError(
              'Content-Type was not one of "multipart/form-data" or "application/x-www-form-urlencoded".'
            );
-          }, instance, false);
+          }, instance);
        },
        bytes() {
          return consumeBody(this, (bytes) => {
-            return new Uint8Array(bytes.buffer, 0, bytes.byteLength);
-          }, instance, true);
+            return new Uint8Array(bytes);
+          }, instance);
        }
      };
      return methods;
@@ -23888,9 +23928,9 @@ Content-Type: ${value.type || "application/octet-stream"}\r
    function mixinBody(prototype) {
      Object.assign(prototype.prototype, bodyMixinMethods(prototype));
    }
-    async function consumeBody(object, convertBytesToJSValue, instance, shouldClone) {
+    async function consumeBody(object, convertBytesToJSValue, instance) {
      webidl.brandCheck(object, instance);
-      if (bodyUnusable(object[kState].body)) {
+      if (bodyUnusable(object)) {
        throw new TypeError("Body is unusable: Body has already been read");
      }
      throwIfAborted(object[kState]);
@@ -23907,10 +23947,11 @@ Content-Type: ${value.type || "application/octet-stream"}\r
        successSteps(Buffer.allocUnsafe(0));
        return promise.promise;
      }
-      await fullyReadBody(object[kState].body, successSteps, errorSteps, shouldClone);
+      await fullyReadBody(object[kState].body, successSteps, errorSteps);
      return promise.promise;
    }
-    function bodyUnusable(body) {
+    function bodyUnusable(object) {
+      const body = object[kState].body;
      return body != null && (body.stream.locked || util.isDisturbed(body.stream));
    }
    function parseJSONFromBytes(bytes) {
@@ -23928,7 +23969,10 @@ Content-Type: ${value.type || "application/octet-stream"}\r
      extractBody,
      safelyExtractBody,
      cloneBody,
-      mixinBody
+      mixinBody,
+      streamRegistry,
+      hasFinalizationRegistry,
+      bodyUnusable
    };
  }
 });
@@ -24660,25 +24704,25 @@ upgrade: ${upgrade}\r
        channels.sendHeaders.publish({ request: request2, headers: header, socket });
      }
      if (!body || bodyLength === 0) {
-        writeBuffer({ abort, body: null, client, request: request2, socket, contentLength, header, expectsPayload });
+        writeBuffer(abort, null, client, request2, socket, contentLength, header, expectsPayload);
      } else if (util.isBuffer(body)) {
-        writeBuffer({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload });
+        writeBuffer(abort, body, client, request2, socket, contentLength, header, expectsPayload);
      } else if (util.isBlobLike(body)) {
        if (typeof body.stream === "function") {
-          writeIterable({ abort, body: body.stream(), client, request: request2, socket, contentLength, header, expectsPayload });
+          writeIterable(abort, body.stream(), client, request2, socket, contentLength, header, expectsPayload);
        } else {
-          writeBlob({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload });
+          writeBlob(abort, body, client, request2, socket, contentLength, header, expectsPayload);
        }
      } else if (util.isStream(body)) {
-        writeStream({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload });
+        writeStream(abort, body, client, request2, socket, contentLength, header, expectsPayload);
      } else if (util.isIterable(body)) {
-        writeIterable({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload });
+        writeIterable(abort, body, client, request2, socket, contentLength, header, expectsPayload);
      } else {
        assert(false);
      }
      return true;
    }
-    function writeStream({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload }) {
+    function writeStream(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
      assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
      let finished = false;
      const writer = new AsyncWriter({ abort, socket, request: request2, contentLength, client, expectsPayload, header });
@@ -24747,7 +24791,7 @@ upgrade: ${upgrade}\r
        setImmediate(onClose);
      }
    }
-    function writeBuffer({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload }) {
+    function writeBuffer(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
      try {
        if (!body) {
          if (contentLength === 0) {
@@ -24778,7 +24822,7 @@ upgrade: ${upgrade}\r
        abort(err);
      }
    }
-    async function writeBlob({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload }) {
+    async function writeBlob(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
      assert(contentLength === body.size, "blob body must have content length");
      try {
        if (contentLength != null && contentLength !== body.size) {
@@ -24801,7 +24845,7 @@ upgrade: ${upgrade}\r
        abort(err);
      }
    }
-    async function writeIterable({ abort, body, client, request: request2, socket, contentLength, header, expectsPayload }) {
+    async function writeIterable(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
      assert(contentLength !== 0 || client[kRunning] === 0, "iterator body cannot be pipelined");
      let callback = null;
      function onDrain() {
@@ -25264,81 +25308,79 @@ var require_client_h2 = __commonJS({
      return true;
      function writeBodyH2() {
        if (!body || contentLength === 0) {
-          writeBuffer({
+          writeBuffer(
            abort,
+            stream,
+            null,
            client,
-            request: request2,
+            request2,
+            client[kSocket],
            contentLength,
-            expectsPayload,
-            h2stream: stream,
-            body: null,
-            socket: client[kSocket]
-          });
+            expectsPayload
+          );
        } else if (util.isBuffer(body)) {
-          writeBuffer({
+          writeBuffer(
            abort,
-            client,
-            request: request2,
-            contentLength,
+            stream,
            body,
-            expectsPayload,
-            h2stream: stream,
-            socket: client[kSocket]
-          });
+            client,
+            request2,
+            client[kSocket],
+            contentLength,
+            expectsPayload
+          );
        } else if (util.isBlobLike(body)) {
          if (typeof body.stream === "function") {
-            writeIterable({
+            writeIterable(
              abort,
+              stream,
+              body.stream(),
              client,
-              request: request2,
+              request2,
+              client[kSocket],
              contentLength,
-              expectsPayload,
-              h2stream: stream,
-              body: body.stream(),
-              socket: client[kSocket]
-            });
+              expectsPayload
+            );
          } else {
-            writeBlob({
+            writeBlob(
              abort,
+              stream,
              body,
              client,
-              request: request2,
+              request2,
+              client[kSocket],
              contentLength,
-              expectsPayload,
-              h2stream: stream,
-              socket: client[kSocket]
-            });
+              expectsPayload
+            );
          }
        } else if (util.isStream(body)) {
-          writeStream({
+          writeStream(
            abort,
+            client[kSocket],
+            expectsPayload,
+            stream,
            body,
            client,
-            request: request2,
-            contentLength,
-            expectsPayload,
-            socket: client[kSocket],
-            h2stream: stream,
-            header: ""
-          });
+            request2,
+            contentLength
+          );
        } else if (util.isIterable(body)) {
-          writeIterable({
+          writeIterable(
            abort,
+            stream,
            body,
            client,
-            request: request2,
+            request2,
+            client[kSocket],
            contentLength,
-            expectsPayload,
-            header: "",
-            h2stream: stream,
-            socket: client[kSocket]
-          });
+            expectsPayload
+          );
        } else {
          assert(false);
        }
      }
    }
-    function writeBuffer({ abort, h2stream, body, client, request: request2, socket, contentLength, expectsPayload }) {
+    function writeBuffer(abort, h2stream, body, client, request2, socket, contentLength, expectsPayload) {
      try {
        if (body != null && util.isBuffer(body)) {
          assert(contentLength === body.byteLength, "buffer body must have content length");
@@ -25357,7 +25399,7 @@ var require_client_h2 = __commonJS({
        abort(error);
      }
    }
-    function writeStream({ abort, socket, expectsPayload, h2stream, body, client, request: request2, contentLength }) {
+    function writeStream(abort, socket, expectsPayload, h2stream, body, client, request2, contentLength) {
      assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
      const pipe = pipeline(
        body,
@@ -25381,7 +25423,7 @@ var require_client_h2 = __commonJS({
        request2.onBodySent(chunk);
      }
    }
-    async function writeBlob({ abort, h2stream, body, client, request: request2, socket, contentLength, expectsPayload }) {
+    async function writeBlob(abort, h2stream, body, client, request2, socket, contentLength, expectsPayload) {
      assert(contentLength === body.size, "blob body must have content length");
      try {
        if (contentLength != null && contentLength !== body.size) {
@@ -25402,7 +25444,7 @@ var require_client_h2 = __commonJS({
        abort(err);
      }
    }
-    async function writeIterable({ abort, h2stream, body, client, request: request2, socket, contentLength, expectsPayload }) {
+    async function writeIterable(abort, h2stream, body, client, request2, socket, contentLength, expectsPayload) {
      assert(contentLength !== 0 || client[kRunning] === 0, "iterator body cannot be pipelined");
      let callback = null;
      function onDrain() {
@@ -26484,8 +26526,13 @@ var require_balanced_pool2 = __commonJS({
    var kMaxWeightPerServer = Symbol("kMaxWeightPerServer");
    var kErrorPenalty = Symbol("kErrorPenalty");
    function getGreatestCommonDivisor(a, b) {
-      if (b === 0) return a;
-      return getGreatestCommonDivisor(b, a % b);
+      if (a === 0) return b;
+      while (b !== 0) {
+        const t = b;
+        b = a % b;
+        a = t;
+      }
+      return a;
    }
    function defaultFactory(origin, opts) {
      return new Pool(origin, opts);
@@ -26539,7 +26586,11 @@ var require_balanced_pool2 = __commonJS({
        return this;
      }
      _updateBalancedPoolStats() {
-        this[kGreatestCommonDivisor] = this[kClients].map((p) => p[kWeight]).reduce(getGreatestCommonDivisor, 0);
+        let result = 0;
+        for (let i = 0; i < this[kClients].length; i++) {
+          result = getGreatestCommonDivisor(this[kClients][i][kWeight], result);
+        }
+        this[kGreatestCommonDivisor] = result;
      }
      removeUpstream(upstream) {
        const upstreamOrigin = parseOrigin(upstream).origin;
@@ -27147,7 +27198,7 @@ var require_retry_handler = __commonJS({
            this.abort(
              new RequestRetryError("Content-Range mismatch", statusCode, {
                headers,
-                count: this.retryCount
+                data: { count: this.retryCount }
              })
            );
            return false;
@@ -27156,7 +27207,7 @@ var require_retry_handler = __commonJS({
            this.abort(
              new RequestRetryError("ETag mismatch", statusCode, {
                headers,
-                count: this.retryCount
+                data: { count: this.retryCount }
              })
            );
            return false;
@@ -29924,7 +29975,7 @@ var require_response2 = __commonJS({
  "node_modules/undici/lib/web/fetch/response.js"(exports2, module2) {
    "use strict";
    var { Headers, HeadersList, fill, getHeadersGuard, setHeadersGuard, setHeadersList } = require_headers2();
-    var { extractBody, cloneBody, mixinBody } = require_body2();
+    var { extractBody, cloneBody, mixinBody, hasFinalizationRegistry, streamRegistry, bodyUnusable } = require_body2();
    var util = require_util8();
    var nodeUtil = require("node:util");
    var { kEnumerableProperty } = util;
@@ -29949,19 +30000,7 @@ var require_response2 = __commonJS({
    var { kConstruct } = require_symbols6();
    var assert = require("node:assert");
    var { types } = require("node:util");
-    var { isDisturbed, isErrored } = require("node:stream");
    var textEncoder = new TextEncoder("utf-8");
-    var hasFinalizationRegistry = globalThis.FinalizationRegistry && process.version.indexOf("v18") !== 0;
-    var registry;
-    if (hasFinalizationRegistry) {
-      registry = new FinalizationRegistry((stream) => {
-        if (!stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
-          stream.cancel("Response object has been garbage collected").catch(noop);
-        }
-      });
-    }
-    function noop() {
-    }
    var Response = class _Response {
      // Creates network error Response.
      static error() {
@@ -30073,7 +30112,7 @@ var require_response2 = __commonJS({
      // Returns a clone of response.
      clone() {
        webidl.brandCheck(this, _Response);
-        if (this.bodyUsed || this.body?.locked) {
+        if (bodyUnusable(this)) {
          throw webidl.errors.exception({
            header: "Response.clone",
            message: "Body has already been consumed."
@@ -30132,7 +30171,7 @@ var require_response2 = __commonJS({
      }
      const newResponse = makeResponse({ ...response, body: null });
      if (response.body != null) {
-        newResponse.body = cloneBody(response.body);
+        newResponse.body = cloneBody(newResponse, response.body);
      }
      return newResponse;
    }
@@ -30257,7 +30296,7 @@ var require_response2 = __commonJS({
      setHeadersList(response[kHeaders], innerResponse.headersList);
      setHeadersGuard(response[kHeaders], guard);
      if (hasFinalizationRegistry && innerResponse.body?.stream) {
-        registry.register(response, innerResponse.body.stream);
+        streamRegistry.register(response, new WeakRef(innerResponse.body.stream));
      }
      return response;
    }
@@ -30372,7 +30411,7 @@ var require_dispatcher_weakref2 = __commonJS({
 var require_request4 = __commonJS({
  "node_modules/undici/lib/web/fetch/request.js"(exports2, module2) {
    "use strict";
-    var { extractBody, mixinBody, cloneBody } = require_body2();
+    var { extractBody, mixinBody, cloneBody, bodyUnusable } = require_body2();
    var { Headers, fill: fillHeaders, HeadersList, setHeadersGuard, getHeadersGuard, setHeadersList, getHeadersList } = require_headers2();
    var { FinalizationRegistry: FinalizationRegistry2 } = require_dispatcher_weakref2()();
    var util = require_util8();
@@ -30380,9 +30419,7 @@ var require_request4 = __commonJS({
    var {
      isValidHTTPToken,
      sameOrigin,
-      normalizeMethod,
-      environmentSettingsObject,
-      normalizeMethodRecord
+      environmentSettingsObject
    } = require_util9();
    var {
      forbiddenMethodsSet,
@@ -30394,7 +30431,7 @@ var require_request4 = __commonJS({
      requestCache,
      requestDuplex
    } = require_constants8();
-    var { kEnumerableProperty } = util;
+    var { kEnumerableProperty, normalizedMethodRecordsBase, normalizedMethodRecords } = util;
    var { kHeaders, kSignal, kState, kDispatcher } = require_symbols7();
    var { webidl } = require_webidl2();
    var { URLSerializer } = require_data_url();
@@ -30591,17 +30628,18 @@ var require_request4 = __commonJS({
        }
        if (init.method !== void 0) {
          let method = init.method;
-          const mayBeNormalized = normalizeMethodRecord[method];
+          const mayBeNormalized = normalizedMethodRecords[method];
          if (mayBeNormalized !== void 0) {
            request2.method = mayBeNormalized;
          } else {
            if (!isValidHTTPToken(method)) {
              throw new TypeError(`'${method}' is not a valid HTTP method.`);
            }
-            if (forbiddenMethodsSet.has(method.toUpperCase())) {
+            const upperCase = method.toUpperCase();
+            if (forbiddenMethodsSet.has(upperCase)) {
              throw new TypeError(`'${method}' HTTP method is unsupported.`);
            }
-            method = normalizeMethod(method);
+            method = normalizedMethodRecordsBase[upperCase] ?? method;
            request2.method = method;
          }
          if (!patchMethodWarning && request2.method === "patch") {
@@ -30694,7 +30732,7 @@ var require_request4 = __commonJS({
        }
        let finalBody = inputOrInitBody;
        if (initBody == null && inputBody != null) {
-          if (util.isDisturbed(inputBody.stream) || inputBody.stream.locked) {
+          if (bodyUnusable(input)) {
            throw new TypeError(
              "Cannot construct a Request with a Request object that has already been used."
            );
@@ -30829,7 +30867,7 @@ var require_request4 = __commonJS({
      // Returns a clone of request.
      clone() {
        webidl.brandCheck(this, _Request);
-        if (this.bodyUsed || this.body?.locked) {
+        if (bodyUnusable(this)) {
          throw new TypeError("unusable");
        }
        const clonedRequest = cloneRequest(this[kState]);
@@ -30922,7 +30960,7 @@ var require_request4 = __commonJS({
    function cloneRequest(request2) {
      const newRequest = makeRequest({ ...request2, body: null });
      if (request2.body != null) {
-        newRequest.body = cloneBody(request2.body);
+        newRequest.body = cloneBody(newRequest, request2.body);
      }
      return newRequest;
    }
@@ -35317,7 +35355,6 @@ var require_websocket2 = __commonJS({
    var { types } = require("node:util");
    var { ErrorEvent, CloseEvent } = require_events2();
    var { SendQueue } = require_sender();
-    var experimentalWarned = false;
    var WebSocket = class _WebSocket extends EventTarget {
      #events = {
        open: null,
@@ -35338,12 +35375,6 @@ var require_websocket2 = __commonJS({
        super();
        const prefix = "WebSocket constructor";
        webidl.argumentLengthCheck(arguments, 1, prefix);
-        if (!experimentalWarned) {
-          experimentalWarned = true;
-          process.emitWarning("WebSockets are experimental, expect them to change at any time.", {
-            code: "UNDICI-WS"
-          });
-        }
        const options = webidl.converters["DOMString or sequence<DOMString> or WebSocketInit"](protocols, prefix, "options");
        url = webidl.converters.USVString(url, prefix, "url");
        protocols = options.protocols;
@@ -36784,132 +36815,116 @@ var RequestError = class extends Error {

 // node_modules/@octokit/request/dist-bundle/index.js
 var VERSION2 = "0.0.0-development";
+var defaults_default = {
+  headers: {
+    "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
+  }
+};
 function isPlainObject2(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  if (Object.prototype.toString.call(value) !== "[object Object]")
-    return false;
+  if (typeof value !== "object" || value === null) return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]") return false;
  const proto = Object.getPrototypeOf(value);
-  if (proto === null)
-    return true;
+  if (proto === null) return true;
  const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
  return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
 }
-function getBufferResponse(response) {
-  return response.arrayBuffer();
-}
-function fetchWrapper(requestOptions) {
-  const log = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
-  const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
-  if (isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body)) {
-    requestOptions.body = JSON.stringify(requestOptions.body);
-  }
-  let headers = {};
-  let status;
-  let url;
-  let { fetch } = globalThis;
-  if (requestOptions.request?.fetch) {
-    fetch = requestOptions.request.fetch;
-  }
+async function fetchWrapper(requestOptions) {
+  const fetch = requestOptions.request?.fetch || globalThis.fetch;
  if (!fetch) {
    throw new Error(
      "fetch is not set. Please pass a fetch implementation as new Octokit({ request: { fetch }}). Learn more at https://github.com/octokit/octokit.js/#fetch-missing"
    );
  }
-  return fetch(requestOptions.url, {
-    method: requestOptions.method,
-    body: requestOptions.body,
-    redirect: requestOptions.request?.redirect,
-    // Header values must be `string`
-    headers: Object.fromEntries(
-      Object.entries(requestOptions.headers).map(([name, value]) => [
-        name,
-        String(value)
-      ])
-    ),
-    signal: requestOptions.request?.signal,
-    // duplex must be set if request.body is ReadableStream or Async Iterables.
-    // See https://fetch.spec.whatwg.org/#dom-requestinit-duplex.
-    ...requestOptions.body && { duplex: "half" }
-  }).then(async (response) => {
-    url = response.url;
-    status = response.status;
-    for (const keyAndValue of response.headers) {
-      headers[keyAndValue[0]] = keyAndValue[1];
-    }
-    if ("deprecation" in headers) {
-      const matches = headers.link && headers.link.match(/<([^>]+)>; rel="deprecation"/);
-      const deprecationLink = matches && matches.pop();
-      log.warn(
-        `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
-      );
-    }
-    if (status === 204 || status === 205) {
-      return;
-    }
-    if (requestOptions.method === "HEAD") {
-      if (status < 400) {
-        return;
+  const log = requestOptions.request?.log || console;
+  const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
+  const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body;
+  const requestHeaders = Object.fromEntries(
+    Object.entries(requestOptions.headers).map(([name, value]) => [
+      name,
+      String(value)
+    ])
+  );
+  let fetchResponse;
+  try {
+    fetchResponse = await fetch(requestOptions.url, {
+      method: requestOptions.method,
+      body,
+      redirect: requestOptions.request?.redirect,
+      headers: requestHeaders,
+      signal: requestOptions.request?.signal,
+      // duplex must be set if request.body is ReadableStream or Async Iterables.
+      // See https://fetch.spec.whatwg.org/#dom-requestinit-duplex.
+      ...requestOptions.body && { duplex: "half" }
+    });
+  } catch (error) {
+    let message = "Unknown Error";
+    if (error instanceof Error) {
+      if (error.name === "AbortError") {
+        error.status = 500;
+        throw error;
      }
-      throw new RequestError(response.statusText, status, {
-        response: {
-          url,
-          status,
-          headers,
-          data: void 0
-        },
-        request: requestOptions
-      });
-    }
-    if (status === 304) {
-      throw new RequestError("Not modified", status, {
-        response: {
-          url,
-          status,
-          headers,
-          data: await getResponseData(response)
-        },
-        request: requestOptions
-      });
-    }
-    if (status >= 400) {
-      const data = await getResponseData(response);
-      const error = new RequestError(toErrorMessage(data), status, {
-        response: {
-          url,
-          status,
-          headers,
-          data
-        },
-        request: requestOptions
-      });
-      throw error;
-    }
-    return parseSuccessResponseBody ? await getResponseData(response) : response.body;
-  }).then((data) => {
-    return {
-      status,
-      url,
-      headers,
-      data
-    };
-  }).catch((error) => {
-    if (error instanceof RequestError)
-      throw error;
-    else if (error.name === "AbortError")
-      throw error;
-    let message = error.message;
-    if (error.name === "TypeError" && "cause" in error) {
-      if (error.cause instanceof Error) {
-        message = error.cause.message;
-      } else if (typeof error.cause === "string") {
-        message = error.cause;
+      message = error.message;
+      if (error.name === "TypeError" && "cause" in error) {
+        if (error.cause instanceof Error) {
+          message = error.cause.message;
+        } else if (typeof error.cause === "string") {
+          message = error.cause;
+        }
      }
    }
-    throw new RequestError(message, 500, {
+    const requestError = new RequestError(message, 500, {
      request: requestOptions
    });
-  });
+    requestError.cause = error;
+    throw requestError;
+  }
+  const status = fetchResponse.status;
+  const url = fetchResponse.url;
+  const responseHeaders = {};
+  for (const [key, value] of fetchResponse.headers) {
+    responseHeaders[key] = value;
+  }
+  const octokitResponse = {
+    url,
+    status,
+    headers: responseHeaders,
+    data: ""
+  };
+  if ("deprecation" in responseHeaders) {
+    const matches = responseHeaders.link && responseHeaders.link.match(/<([^>]+)>; rel="deprecation"/);
+    const deprecationLink = matches && matches.pop();
+    log.warn(
+      `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${responseHeaders.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
+    );
+  }
+  if (status === 204 || status === 205) {
+    return octokitResponse;
+  }
+  if (requestOptions.method === "HEAD") {
+    if (status < 400) {
+      return octokitResponse;
+    }
+    throw new RequestError(fetchResponse.statusText, status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status === 304) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError("Not modified", status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status >= 400) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError(toErrorMessage(octokitResponse.data), status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  octokitResponse.data = parseSuccessResponseBody ? await getResponseData(fetchResponse) : fetchResponse.body;
+  return octokitResponse;
 }
 async function getResponseData(response) {
  const contentType = response.headers.get("content-type");
@@ -36919,22 +36934,18 @@ async function getResponseData(response) {
  if (!contentType || /^text\/|charset=utf-8$/.test(contentType)) {
    return response.text();
  }
-  return getBufferResponse(response);
+  return response.arrayBuffer();
 }
 function toErrorMessage(data) {
-  if (typeof data === "string")
+  if (typeof data === "string") {
    return data;
-  let suffix;
-  if ("documentation_url" in data) {
-    suffix = ` - ${data.documentation_url}`;
-  } else {
-    suffix = "";
+  }
+  if (data instanceof ArrayBuffer) {
+    return "Unknown error";
  }
  if ("message" in data) {
-    if (Array.isArray(data.errors)) {
-      return `${data.message}: ${data.errors.map(JSON.stringify).join(", ")}${suffix}`;
-    }
-    return `${data.message}${suffix}`;
+    const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : "";
+    return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`;
  }
  return `Unknown error: ${JSON.stringify(data)}`;
 }
@@ -36961,11 +36972,7 @@ function withDefaults2(oldEndpoint, newDefaults) {
    defaults: withDefaults2.bind(null, endpoint2)
  });
 }
-var request = withDefaults2(endpoint, {
-  headers: {
-    "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
-  }
-});
+var request = withDefaults2(endpoint, defaults_default);

 // lib/request.js
 var import_undici = __toESM(require_undici2(), 1);
@@ -5,7 +5,7 @@ import pRetry from "p-retry";
 * @param {string} appId
 * @param {string} privateKey
 * @param {string} owner
- * @param {string} repositories
+ * @param {string[]} repositories
 * @param {import("@actions/core")} core
 * @param {import("@octokit/auth-app").createAppAuth} createAppAuth
 * @param {import("@octokit/request").request} request
@@ -22,21 +22,23 @@ export async function main(
  skipTokenRevoke
 ) {
  let parsedOwner = "";
-  let parsedRepositoryNames = "";
+  let parsedRepositoryNames = [];

  // If neither owner nor repositories are set, default to current repository
-  if (!owner && !repositories) {
-    [parsedOwner, parsedRepositoryNames] = String(
+  if (!owner && repositories.length === 0) {
+    const [owner, repo] = String(
      process.env.GITHUB_REPOSITORY
    ).split("/");
+    parsedOwner = owner;
+    parsedRepositoryNames = [repo];

    core.info(
-      `owner and repositories not set, creating token for the current repository ("${parsedRepositoryNames}")`
+      `owner and repositories not set, creating token for the current repository ("${repo}")`
    );
  }

  // If only an owner is set, default to all repositories from that owner
-  if (owner && !repositories) {
+  if (owner && repositories.length === 0) {
    parsedOwner = owner;

    core.info(
@@ -45,22 +47,22 @@ export async function main(
  }

  // If repositories are set, but no owner, default to `GITHUB_REPOSITORY_OWNER`
-  if (!owner && repositories) {
+  if (!owner && repositories.length > 0) {
    parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
    parsedRepositoryNames = repositories;

    core.info(
-      `owner not set, creating owner for given repositories "${repositories}" in current owner ("${parsedOwner}")`
+      `owner not set, creating owner for given repositories "${repositories.join(',')}" in current owner ("${parsedOwner}")`
    );
  }

  // If both owner and repositories are set, use those values
-  if (owner && repositories) {
+  if (owner && repositories.length > 0) {
    parsedOwner = owner;
    parsedRepositoryNames = repositories;

    core.info(
-      `owner and repositories set, creating token for repositories "${repositories}" owned by "${owner}"`
+      `owner and repositories set, creating token for repositories "${repositories.join(',')}" owned by "${owner}"`
    );
  }

@@ -73,11 +75,11 @@ export async function main(
  let authentication, installationId, appSlug;
  // If at least one repository is set, get installation ID from that repository

-  if (parsedRepositoryNames) {
+  if (parsedRepositoryNames.length > 0) {
    ({ authentication, installationId, appSlug } = await pRetry(() => getTokenFromRepository(request, auth, parsedOwner, parsedRepositoryNames), {
      onFailedAttempt: (error) => {
        core.info(
-          `Failed to create token for "${parsedRepositoryNames}" (attempt ${error.attemptNumber}): ${error.message}`
+          `Failed to create token for "${parsedRepositoryNames.join(',')}" (attempt ${error.attemptNumber}): ${error.message}`
        );
      },
      retries: 3,
@@ -104,7 +106,7 @@ export async function main(
  // Make token accessible to post function (so we can invalidate it)
  if (!skipTokenRevoke) {
    core.saveState("token", authentication.token);
-    core.setOutput("expiresAt", authentication.expiresAt);
+    core.saveState("expiresAt", authentication.expiresAt);
  }
 }

@@ -144,7 +146,7 @@ async function getTokenFromRepository(request, auth, parsedOwner, parsedReposito
  // https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app
  const response = await request("GET /repos/{owner}/{repo}/installation", {
    owner: parsedOwner,
-    repo: parsedRepositoryNames.split(",")[0],
+    repo: parsedRepositoryNames[0],
    request: {
      hook: auth.hook,
    },
@@ -154,11 +156,11 @@ async function getTokenFromRepository(request, auth, parsedOwner, parsedReposito
  const authentication = await auth({
    type: "installation",
    installationId: response.data.id,
-    repositoryNames: parsedRepositoryNames.split(","),
+    repositoryNames: parsedRepositoryNames,
  });

  const installationId = response.data.id;
  const appSlug = response.data['app_slug'];

  return { authentication, installationId, appSlug };
- }
+}
@@ -25,7 +25,10 @@ if (!privateKey) {
  throw new Error("Input required and not supplied: private-key");
 }
 const owner = core.getInput("owner");
-const repositories = core.getInput("repositories");
+const repositories = core.getInput("repositories")
+  .split(/[\n,]+/)
+  .map(s => s.trim())
+  .filter(x => x !== '');

 const skipTokenRevoke = Boolean(
  core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke")
@@ -2,10 +2,10 @@
  "name": "create-github-app-token",
  "private": true,
  "type": "module",
-  "version": "1.10.1",
+  "version": "1.11.0",
  "description": "GitHub Action for creating a GitHub App Installation Access Token",
  "scripts": {
-    "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0",
+    "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0 --packages=bundle",
    "test": "c8 --100 ava tests/index.js",
    "coverage": "c8 report --reporter html",
    "postcoverage": "open-cli coverage/index.html"
@@ -13,20 +13,20 @@
  "license": "MIT",
  "dependencies": {
    "@actions/core": "^1.10.1",
-    "@octokit/auth-app": "^7.1.0",
-    "@octokit/request": "^9.0.1",
+    "@octokit/auth-app": "^7.1.1",
+    "@octokit/request": "^9.1.3",
    "p-retry": "^6.2.0",
-    "undici": "^6.18.2"
+    "undici": "^6.19.8"
  },
  "devDependencies": {
-    "@sinonjs/fake-timers": "^11.2.2",
+    "@sinonjs/fake-timers": "^13.0.1",
    "ava": "^6.1.3",
-    "c8": "^9.1.0",
+    "c8": "^10.1.2",
    "dotenv": "^16.4.5",
-    "esbuild": "^0.21.4",
-    "execa": "^9.1.0",
+    "esbuild": "^0.23.1",
+    "execa": "^9.3.1",
    "open-cli": "^8.0.0",
-    "yaml": "^2.4.2"
+    "yaml": "^2.5.1"
  },
  "release": {
    "branches": [
@@ -1,11 +1,21 @@
 import { readdirSync } from "node:fs";

-import { execa } from "execa";
 import test from "ava";
+import { execa } from "execa";

-const tests = readdirSync("tests").filter((file) => file.endsWith(".test.js"));
+// Get all files in tests directory
+const files = readdirSync("tests");

-for (const file of tests) {
+// Files to ignore
+const ignore = ["index.js", "main.js", "README.md", "snapshots"];
+
+const testFiles = files.filter((file) => !ignore.includes(file));
+
+// Throw an error if there is a file that does not end with test.js in the tests directory
+for (const file of testFiles) {
+  if (!file.endsWith(".test.js")) {
+    throw new Error(`File ${file} does not end with .test.js`);
+  }
  test(file, async (t) => {
    // Override Actions environment variables that change `core`’s behavior
    const env = {
@@ -1,10 +1,11 @@
-import { test, DEFAULT_ENV } from "./main.js";
+import { DEFAULT_ENV, test } from "./main.js";

 // Verify that main works with a custom GitHub API URL passed as `github-api-url` input
 await test(
  () => {
    process.env.INPUT_OWNER = process.env.GITHUB_REPOSITORY_OWNER;
-    process.env.INPUT_REPOSITORIES = process.env.GITHUB_REPOSITORY;
+    const currentRepoName = process.env.GITHUB_REPOSITORY.split("/")[1];
+    process.env.INPUT_REPOSITORIES = currentRepoName;
  },
  {
    ...DEFAULT_ENV,
@@ -1,6 +0,0 @@
-import { test, DEFAULT_ENV } from "./main.js";
-
-// Verify `main` works correctly when `private-key` input has escaped newlines
-await test(() => {
-  process.env['INPUT_PRIVATE-KEY'] = DEFAULT_ENV.PRIVATE_KEY.replace(/\n/g, '\\n')
-});
@@ -0,0 +1,9 @@
+import { DEFAULT_ENV, test } from "./main.js";
+
+// Verify `main` works correctly when `private-key` input has escaped newlines
+await test(() => {
+  process.env["INPUT_PRIVATE-KEY"] = DEFAULT_ENV["INPUT_PRIVATE-KEY"].replace(
+    /\n/g,
+    "\\n"
+  );
+});
@@ -0,0 +1,9 @@
+import { test } from "./main.js";
+
+// Verify `main` successfully obtains a token when the `owner` and `repositories` inputs are set (and the latter is a list of repos).
+await test(() => {
+  process.env.INPUT_OWNER = process.env.GITHUB_REPOSITORY_OWNER;
+  const currentRepoName = process.env.GITHUB_REPOSITORY.split("/")[1];
+  // Intentional unnecessary whitespace to test parsing to array
+  process.env.INPUT_REPOSITORIES = `\n ${currentRepoName}\ntoolkit \n\n checkout \n`;
+});
@@ -3,5 +3,7 @@ import { test } from "./main.js";
 // Verify `main` successfully obtains a token when the `owner` and `repositories` inputs are set (and the latter is a list of repos).
 await test(() => {
  process.env.INPUT_OWNER = process.env.GITHUB_REPOSITORY_OWNER;
-  process.env.INPUT_REPOSITORIES = `${process.env.GITHUB_REPOSITORY},actions/toolkit`;
+  const currentRepoName = process.env.GITHUB_REPOSITORY.split("/")[1];
+  // Intentional unnecessary whitespace to test parsing to array
+  process.env.INPUT_REPOSITORIES = ` ${currentRepoName}, toolkit  ,checkout`;
 });
@@ -3,5 +3,6 @@ import { test } from "./main.js";
 // Verify `main` successfully obtains a token when the `owner` and `repositories` inputs are set (and the latter is a single repo).
 await test(() => {
  process.env.INPUT_OWNER = process.env.GITHUB_REPOSITORY_OWNER;
-  process.env.INPUT_REPOSITORIES = process.env.GITHUB_REPOSITORY;
+  const currentRepoName = process.env.GITHUB_REPOSITORY.split("/")[1];
+  process.env.INPUT_REPOSITORIES = currentRepoName;
 });
@@ -3,5 +3,6 @@ import { test } from "./main.js";
 // Verify `main` successfully obtains a token when the `owner` input is not set, but the `repositories` input is set.
 await test(() => {
  delete process.env.INPUT_OWNER;
-  process.env.INPUT_REPOSITORIES = process.env.GITHUB_REPOSITORY;
+  const currentRepoName = process.env.GITHUB_REPOSITORY.split("/")[1];
+  process.env.INPUT_REPOSITORIES = currentRepoName;
 });
@@ -46,7 +46,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {

  // Set up mocking
  const baseUrl = new URL(env["INPUT_GITHUB-API-URL"]);
-  const basePath = baseUrl.pathname === '/' ? '' : baseUrl.pathname;
+  const basePath = baseUrl.pathname === "/" ? "" : baseUrl.pathname;
  const mockAgent = new MockAgent();
  mockAgent.disableNetConnect();
  setGlobalDispatcher(mockAgent);
@@ -58,8 +58,9 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
  const mockInstallationId = "123456";
  const mockAppSlug = "github-actions";
  const owner = env.INPUT_OWNER ?? env.GITHUB_REPOSITORY_OWNER;
+  const currentRepoName = env.GITHUB_REPOSITORY.split("/")[1];
  const repo = encodeURIComponent(
-    (env.INPUT_REPOSITORIES ?? env.GITHUB_REPOSITORY).split(",")[0]
+    (env.INPUT_REPOSITORIES ?? currentRepoName).split(",")[0]
  );
  mockPool
    .intercept({
@@ -73,7 +74,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
    })
    .reply(
      200,
-      { id: mockInstallationId, "app_slug": mockAppSlug },
+      { id: mockInstallationId, app_slug: mockAppSlug },
      { headers: { "content-type": "application/json" } }
    );

@@ -24,7 +24,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "actions/create-github-app-token" owned by "actions"␊
+    `owner and repositories set, creating token for repositories "create-github-app-token" owned by "actions"␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -33,8 +33,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-missing-app-id.test.js

@@ -76,6 +75,45 @@ Generated by [AVA](https://avajs.dev).

    ''

+## main-private-key-with-escaped-newlines.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    `owner and repositories not set, creating token for the current repository ("create-github-app-token")␊
+    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=installation-id::123456␊
+    ␊
+    ::set-output name=app-slug::github-actions␊
+    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`
+
+## main-repo-skew.test.js
+
+> stderr
+
+    `'Issued at' claim ('iat') must be an Integer representing the time that the assertion was issued.␊
+    [@octokit/auth-app] GitHub API time and system time are different by 30 seconds. Retrying request with the difference accounted for.`
+
+> stdout
+
+    `owner and repositories set, creating token for repositories "failed-repo" owned by "actions"␊
+    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=installation-id::123456␊
+    ␊
+    ::set-output name=app-slug::github-actions␊
+    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`
+
 ## main-token-get-owner-set-repo-fail-response.test.js

 > stderr
@@ -94,8 +132,26 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`
+
+## main-token-get-owner-set-repo-set-to-many-newline.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    `owner and repositories set, creating token for repositories "create-github-app-token,toolkit,checkout" owned by "actions"␊
+    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=installation-id::123456␊
+    ␊
+    ::set-output name=app-slug::github-actions␊
+    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-set-repo-set-to-many.test.js

@@ -105,7 +161,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "actions/create-github-app-token,actions/toolkit" owned by "actions"␊
+    `owner and repositories set, creating token for repositories "create-github-app-token,toolkit,checkout" owned by "actions"␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -114,8 +170,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-set-repo-set-to-one.test.js

@@ -125,7 +180,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "actions/create-github-app-token" owned by "actions"␊
+    `owner and repositories set, creating token for repositories "create-github-app-token" owned by "actions"␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -134,8 +189,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-set-to-org-repo-unset.test.js

@@ -154,8 +208,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-set-to-user-fail-response.test.js

@@ -175,8 +228,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-set-to-user-repo-unset.test.js

@@ -195,8 +247,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-unset-repo-set.test.js

@@ -206,7 +257,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner not set, creating owner for given repositories "actions/create-github-app-token" in current owner ("actions")␊
+    `owner not set, creating owner for given repositories "create-github-app-token" in current owner ("actions")␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -215,8 +266,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## main-token-get-owner-unset-repo-unset.test.js

@@ -235,8 +285,7 @@ Generated by [AVA](https://avajs.dev).
    ␊
    ::set-output name=app-slug::github-actions␊
    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+    ::save-state name=expiresAt::2016-07-11T22:14:10Z`

 ## post-revoke-token-fail-response.test.js