build(release): 3.0.0-beta.2 [skip ci]

# [3.0.0-beta.2](https://github.com/actions/create-github-app-token/compare/v3.0.0-beta.1...v3.0.0-beta.2) (2025-08-22) ### Bug Fixes * remove custom proxy handling ([#143](https://github.com/actions/create-github-app-token/issues/143)) ([cda91bf](https://github.com/actions/create-github-app-token/commit/cda91bf2b93cf1d3306b458b2a4f7fcd9de9175f)), closes [#134](https://github.com/actions/create-github-app-token/issues/134)
fix: remove custom proxy handling (#143 )
2025-08-22 19:16:51 +00:00 · 2025-08-22 12:16:16 -07:00 · 2025-08-15 13:03:02 -07:00 · 2025-08-15 19:55:36 +00:00 · 2025-08-15 12:55:04 -07:00 · 2025-08-15 12:34:57 -07:00
29 changed files with 1472 additions and 41995 deletions
@@ -12,6 +12,6 @@ jobs:
      id-token: write
      packages: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - name: Publish Immutable Action
        uses: actions/publish-immutable-action@v0.0.4
@@ -3,7 +3,9 @@ name: release
 on:
  push:
    branches:
+      - "*.x"
      - main
+      - beta

 permissions:
  contents: write
@@ -16,13 +18,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      # build local version to create token
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with:
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
-          node-version-file: .node-version
+          node-version-file: package.json
          cache: 'npm'

      - run: npm ci
@@ -11,16 +11,19 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  integration:
    name: Integration
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5

      - uses: actions/setup-node@v4
        with:
-          node-version-file: .node-version
+          node-version-file: package.json
          cache: 'npm'

      - run: npm ci
@@ -32,11 +35,11 @@ jobs:
    # do not run from forks, as forks don’t have access to repository secrets
    if: github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4
        with:
-          node-version: 20
-          cache: "npm"
+          node-version-file: package.json
+          cache: 'npm'
      - run: npm ci
      - run: npm run build
      - uses: ./ # Uses the action in the root directory
@@ -0,0 +1,33 @@
+name: Update Permission Inputs
+
+on:
+  pull_request:
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  update-permission-inputs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - name: Run permission inputs update script
+        run: node scripts/update-permission-inputs.js
+      - name: Commit changes
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+        with:
+          commit_message: 'feat: update permission inputs'
@@ -1 +0,0 @@
-20.9.0
@@ -12,4 +12,4 @@ Run tests locally
 npm test
 ```

-Learn more about how the tests work in [test/README.md](test/README.md).
+Learn more about how the tests work in [tests/README.md](tests/README.md).
@@ -8,9 +8,9 @@ GitHub Action for creating a GitHub App installation access token.

 In order to use this action, you need to:

-1. [Register new GitHub App](https://docs.github.com/apps/creating-github-apps/setting-up-a-github-app/creating-a-github-app)
-2. [Store the App's ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`)
-3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`)
+1. [Register new GitHub App](https://docs.github.com/apps/creating-github-apps/setting-up-a-github-app/creating-a-github-app).
+2. [Store the App's ID or Client ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`).
+3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`).

 > [!IMPORTANT]  
 > An installation access token expires after 1 hour. Please [see this comment](https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796) for alternative approaches if you have long-running processes.
@@ -28,7 +28,7 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -47,13 +47,13 @@ jobs:
  auto-format:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          # required
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: ${{ github.head_ref }}
@@ -73,7 +73,7 @@ jobs:
  auto-format:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          # required
@@ -98,7 +98,7 @@ jobs:
  auto-format:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          # required
@@ -135,7 +135,7 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -157,7 +157,7 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -182,7 +182,7 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -207,7 +207,7 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -249,7 +249,7 @@ jobs:
        owners-and-repos: ${{ fromJson(needs.set-matrix.outputs.matrix) }}

    steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
@@ -279,7 +279,7 @@ jobs:
    steps:
      - name: Create GitHub App token
        id: create_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ vars.GHES_APP_ID }}
          private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }}
@@ -318,7 +318,7 @@ steps:
      echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
  - name: Generate GitHub App Token
    id: app-token
-    uses: actions/create-github-app-token@v1
+    uses: actions/create-github-app-token@v3
    with:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ steps.decode.outputs.private-key }}
@@ -343,7 +343,7 @@ The reason we define one `permision-<permission name>` input per permission is t

 ### `skip-token-revoke`

-**Optional:** If truthy, the token will not be revoked when the current job is complete.
+**Optional:** If true, the token will not be revoked when the current job is complete.

 ### `github-api-url`

@@ -370,7 +370,7 @@ The action creates an installation access token using [the `POST /app/installati
 1. The token is scoped to the current repository or `repositories` if set.
 2. The token inherits all the installation's permissions.
 3. The token is set as output `token` which can be used in subsequent steps.
-4. Unless the `skip-token-revoke` input is set to a truthy value, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
+4. Unless the `skip-token-revoke` input is set to true, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
 5. The token is masked, it cannot be logged accidentally.

 > [!NOTE]
@@ -7,18 +7,10 @@ branding:
 inputs:
  app-id:
    description: "GitHub App ID"
-    required: false # TODO: When 'app_id' is removed, make 'app-id' required
-  app_id:
-    description: "GitHub App ID"
-    required: false
-    deprecationMessage: "'app_id' is deprecated and will be removed in a future version. Use 'app-id' instead."
+    required: true
  private-key:
    description: "GitHub App private key"
-    required: false # TODO: When 'private_key' is removed, make 'private-key' required
-  private_key:
-    description: "GitHub App private key"
-    required: false
-    deprecationMessage: "'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead."
+    required: true
  owner:
    description: "The owner of the GitHub App installation (defaults to current repository owner)"
    required: false
@@ -26,12 +18,9 @@ inputs:
    description: "Comma or newline-separated list of repositories to install the GitHub App on (defaults to current repository if owner is unset)"
    required: false
  skip-token-revoke:
-    description: "If truthy, the token will not be revoked when the current job is complete"
+    description: "If true, the token will not be revoked when the current job is complete"
    required: false
-  skip_token_revoke:
-    description: "If truthy, the token will not be revoked when the current job is complete"
-    required: false
-    deprecationMessage: "'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead."
+    default: "false"
  # Make GitHub API configurable to support non-GitHub Cloud use cases
  # see https://github.com/actions/create-github-app-token/issues/77
  github-api-url:
@@ -49,7 +38,7 @@ inputs:
  permission-contents:
    description: "The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. Can be set to 'read' or 'write'."
  permission-dependabot-secrets:
-    description: "The leve of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'."
+    description: "The level of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'."
  permission-deployments:
    description: "The level of permission to grant the access token for deployments and deployment statuses. Can be set to 'read' or 'write'."
  permission-email-addresses:
@@ -143,6 +132,6 @@ outputs:
  app-slug:
    description: "GitHub App slug"
 runs:
-  using: "node20"
+  using: "node24"
  main: "dist/main.cjs"
  post: "dist/post.cjs"
@@ -1,25 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="106"
-    height="20" role="img" aria-label="Coverage: 100%">
-    <title>Coverage: 100%</title>
-    <linearGradient id="s" x2="0" y2="100%">
-        <stop offset="0" stop-color="#bbb" stop-opacity=".1" />
-        <stop offset="1" stop-opacity=".1" />
-    </linearGradient>
-    <clipPath id="r">
-        <rect width="106" height="20" rx="3" fill="#fff" />
-    </clipPath>
-    <g clip-path="url(#r)">
-        <rect width="63" height="20" fill="#555" />
-        <rect x="63" width="43" height="20" fill="#4c1" />
-        <rect width="106" height="20" fill="url(#s)" />
-    </g>
-    <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif"
-        text-rendering="geometricPrecision" font-size="110">
-        <text aria-hidden="true" x="325" y="150" fill="#010101" fill-opacity=".3"
-            transform="scale(.1)" textLength="530">Coverage</text>
-        <text x="325" y="140" transform="scale(.1)" fill="#fff" textLength="530">Coverage</text>
-        <text aria-hidden="true" x="835" y="150" fill="#010101" fill-opacity=".3"
-            transform="scale(.1)" textLength="330">100%</text>
-        <text x="835" y="140" transform="scale(.1)" fill="#fff" textLength="330">100%</text>
-    </g>
-</svg>
@@ -7,9 +7,13 @@
 */
 export function getPermissionsFromInputs(env) {
  return Object.entries(env).reduce((permissions, [key, value]) => {
-    if (!key.startsWith("INPUT_PERMISSION_")) return permissions;
+    if (!key.startsWith("INPUT_PERMISSION-")) return permissions;
+    if (!value) return permissions;

-    const permission = key.slice("INPUT_PERMISSION_".length).toLowerCase();
+    const permission = key.slice("INPUT_PERMISSION-".length).toLowerCase()
+      .replaceAll(/-/g, "_");
+
+    // Inherit app permissions if no permissions inputs are set
    if (permissions === undefined) {
      return { [permission]: value };
    }
@@ -21,7 +21,7 @@ export async function main(
  core,
  createAppAuth,
  request,
-  skipTokenRevoke,
+  skipTokenRevoke
 ) {
  let parsedOwner = "";
  let parsedRepositoryNames = [];
@@ -33,7 +33,7 @@ export async function main(
    parsedRepositoryNames = [repo];

    core.info(
-      `owner and repositories not set, creating token for the current repository ("${repo}")`,
+      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner}/${repo}).`
    );
  }

@@ -42,7 +42,7 @@ export async function main(
    parsedOwner = owner;

    core.info(
-      `repositories not set, creating token for all repositories for given owner "${owner}"`,
+      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
    );
  }

@@ -52,9 +52,9 @@ export async function main(
    parsedRepositoryNames = repositories;

    core.info(
-      `owner not set, creating owner for given repositories "${repositories.join(
-        ",",
-      )}" in current owner ("${parsedOwner}")`,
+      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
+        .map((repo) => `\n- ${parsedOwner}/${repo}`)
+        .join("")}`
    );
  }

@@ -64,9 +64,8 @@ export async function main(
    parsedRepositoryNames = repositories;

    core.info(
-      `owner and repositories set, creating token for repositories "${repositories.join(
-        ",",
-      )}" owned by "${owner}"`,
+      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
+      ${repositories.map((repo) => `\n- ${parsedOwner}/${repo}`).join("")}`
    );
  }

@@ -87,18 +86,19 @@ export async function main(
          auth,
          parsedOwner,
          parsedRepositoryNames,
-          permissions,
+          permissions
        ),
      {
+        shouldRetry: (error) => error.status >= 500,
        onFailedAttempt: (error) => {
          core.info(
            `Failed to create token for "${parsedRepositoryNames.join(
-              ",",
-            )}" (attempt ${error.attemptNumber}): ${error.message}`,
+              ","
+            )}" (attempt ${error.attemptNumber}): ${error.message}`
          );
        },
        retries: 3,
-      },
+      }
    ));
  } else {
    // Otherwise get the installation for the owner, which can either be an organization or a user account
@@ -107,11 +107,11 @@ export async function main(
      {
        onFailedAttempt: (error) => {
          core.info(
-            `Failed to create token for "${parsedOwner}" (attempt ${error.attemptNumber}): ${error.message}`,
+            `Failed to create token for "${parsedOwner}" (attempt ${error.attemptNumber}): ${error.message}`
          );
        },
        retries: 3,
-      },
+      }
    ));
  }

@@ -157,7 +157,7 @@ async function getTokenFromRepository(
  auth,
  parsedOwner,
  parsedRepositoryNames,
-  permissions,
+  permissions
 ) {
  // https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app
  const response = await request("GET /repos/{owner}/{repo}/installation", {
@@ -5,9 +5,7 @@
 * @param {import("@octokit/request").request} request
 */
 export async function post(core, request) {
-  const skipTokenRevoke = Boolean(
-    core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke")
-  );
+  const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");

  if (skipTokenRevoke) {
    core.info("Token revocation was skipped");
@@ -35,8 +33,7 @@ export async function post(core, request) {
    });
    core.info("Token revoked");
  } catch (error) {
-    core.warning(
-      `Token revocation failed: ${error.message}`)
+    core.warning(`Token revocation failed: ${error.message}`);
  }
 }

@@ -1,41 +1,11 @@
 import core from "@actions/core";
 import { request } from "@octokit/request";
-import { ProxyAgent, fetch as undiciFetch } from "undici";

+// Get the GitHub API URL from the action input and remove any trailing slash
 const baseUrl = core.getInput("github-api-url").replace(/\/$/, "");

-// https://docs.github.com/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners
-const proxyUrl =
-  process.env.https_proxy ||
-  process.env.HTTPS_PROXY ||
-  process.env.http_proxy ||
-  process.env.HTTP_PROXY;
-
-/* c8 ignore start */
-// Native support for proxies in Undici is under consideration: https://github.com/nodejs/undici/issues/1650
-// Until then, we need to use a custom fetch function to add proxy support.
-const proxyFetch = (url, options) => {
-  const urlHost = new URL(url).hostname;
-  const noProxy = (process.env.no_proxy || process.env.NO_PROXY || "").split(
-    ",",
-  );
-
-  if (!noProxy.includes(urlHost)) {
-    options = {
-      ...options,
-      dispatcher: new ProxyAgent(String(proxyUrl)),
-    };
-  }
-
-  return undiciFetch(url, options);
-};
-/* c8 ignore stop */
-
+// Configure the default settings for GitHub API requests
 export default request.defaults({
-  headers: {
-    "user-agent": "actions/create-github-app-token",
-  },
+  headers: { "user-agent": "actions/create-github-app-token" },
  baseUrl,
-  /* c8 ignore next */
-  request: proxyUrl ? { fetch: proxyFetch } : {},
 });
@@ -3,9 +3,9 @@
 import core from "@actions/core";
 import { createAppAuth } from "@octokit/auth-app";

+import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
 import { main } from "./lib/main.js";
 import request from "./lib/request.js";
-import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";

 if (!process.env.GITHUB_REPOSITORY) {
  throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -15,16 +15,8 @@ if (!process.env.GITHUB_REPOSITORY_OWNER) {
  throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
 }

-const appId = core.getInput("app-id") || core.getInput("app_id");
-if (!appId) {
-  // The 'app_id' input was previously required, but it and 'app-id' are both optional now, until the former is removed. Still, we want to ensure that at least one of them is set.
-  throw new Error("Input required and not supplied: app-id");
-}
-const privateKey = core.getInput("private-key") || core.getInput("private_key");
-if (!privateKey) {
-  // The 'private_key' input was previously required, but it and 'private-key' are both optional now, until the former is removed. Still, we want to ensure that at least one of them is set.
-  throw new Error("Input required and not supplied: private-key");
-}
+const appId = core.getInput("app-id");
+const privateKey = core.getInput("private-key");
 const owner = core.getInput("owner");
 const repositories = core
  .getInput("repositories")
@@ -32,9 +24,7 @@ const repositories = core
  .map((s) => s.trim())
  .filter((x) => x !== "");

-const skipTokenRevoke = Boolean(
-  core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke"),
-);
+const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");

 const permissions = getPermissionsFromInputs(process.env);

@@ -2,10 +2,13 @@
  "name": "create-github-app-token",
  "private": true,
  "type": "module",
-  "version": "1.12.0",
+  "version": "3.0.0-beta.2",
  "description": "GitHub Action for creating a GitHub App Installation Access Token",
+  "engines": {
+    "node": ">=24.4.0"
+  },
  "scripts": {
-    "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0 --packages=bundle",
+    "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --packages=bundle",
    "test": "c8 --100 ava tests/index.js",
    "coverage": "c8 report --reporter html",
    "postcoverage": "open-cli coverage/index.html"
@@ -13,38 +16,42 @@
  "license": "MIT",
  "dependencies": {
    "@actions/core": "^1.11.1",
-    "@octokit/auth-app": "^7.1.5",
+    "@octokit/auth-app": "^7.2.1",
    "@octokit/request": "^9.2.2",
-    "p-retry": "^6.2.1",
-    "undici": "^7.5.0"
+    "p-retry": "^6.2.1"
  },
  "devDependencies": {
-    "@octokit/openapi": "^18.0.0",
+    "@octokit/openapi": "^19.1.0",
    "@sinonjs/fake-timers": "^14.0.0",
-    "ava": "^6.2.0",
+    "ava": "^6.4.1",
    "c8": "^10.1.3",
-    "dotenv": "^16.4.7",
-    "esbuild": "^0.25.0",
-    "execa": "^9.5.2",
+    "dotenv": "^17.2.1",
+    "esbuild": "^0.25.8",
+    "execa": "^9.6.0",
    "open-cli": "^8.0.0",
-    "yaml": "^2.7.0"
+    "undici": "^7.13.0",
+    "yaml": "^2.8.1"
  },
  "release": {
    "branches": [
      "+([0-9]).x",
-      "main"
+      "main",
+      {
+        "name": "beta",
+        "prerelease": true
+      }
    ],
    "plugins": [
      "@semantic-release/commit-analyzer",
      "@semantic-release/release-notes-generator",
      "@semantic-release/github",
      "@semantic-release/npm",
-      "semantic-release-plugin-github-breaking-version-tag",
      [
        "@semantic-release/git",
        {
          "assets": [
            "package.json",
+            "package-lock.json",
            "dist/*"
          ],
          "message": "build(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
@@ -45,7 +45,7 @@
    },
    "dependabot_secrets": {
      "type": "string",
-      "description": "The leve of permission to grant the access token to manage Dependabot secrets.",
+      "description": "The level of permission to grant the access token to manage Dependabot secrets.",
      "enum": [
        "read",
        "write"
@@ -1,9 +0,0 @@
-process.env.GITHUB_REPOSITORY_OWNER = "actions";
-process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
-
-// Verify `main` exits with an error when neither the `app-id` nor `app_id` input is set.
-try {
-  await import("../main.js");
-} catch (error) {
-  console.error(error.message);
-}
@@ -1,10 +0,0 @@
-process.env.GITHUB_REPOSITORY_OWNER = "actions";
-process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
-process.env["INPUT_APP-ID"] = "123456";
-
-// Verify `main` exits with an error when neither the `private-key` nor `private_key` input is set.
-try {
-  await import("../main.js");
-} catch (error) {
-  console.error(error.message);
-}
@@ -2,6 +2,6 @@ import { test } from "./main.js";

 // Verify `main` successfully sets permissions
 await test(() => {
-  process.env.INPUT_PERMISSION_ISSUES = `write`;
-  process.env.INPUT_PERMISSION_PULL_REQUESTS = `read`;
+  process.env["INPUT_PERMISSION-ISSUES"] = `write`;
+  process.env["INPUT_PERMISSION-PULL-REQUESTS"] = `read`;
 });
@@ -8,6 +8,7 @@ export const DEFAULT_ENV = {
  // inputs are set as environment variables with the prefix INPUT_
  // https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
  "INPUT_GITHUB-API-URL": "https://api.github.com",
+  "INPUT_SKIP-TOKEN-REVOKE": "false",
  "INPUT_APP-ID": "123456",
  // This key is invalidated. It’s from https://github.com/octokit/auth-app.js/issues/465#issuecomment-1564998327.
  "INPUT_PRIVATE-KEY": `-----BEGIN RSA PRIVATE KEY-----
@@ -37,6 +38,8 @@ so0tiQKBgGQXZaxaXhYUcxYHuCkQ3V4Vsj3ezlM92xXlP32SGFm3KgFhYy9kATxw
 Cax1ytZzvlrKLQyQFVK1COs2rHt7W4cJ7op7C8zXfsigXCiejnS664oAuX8sQZID
 x3WQZRiXlWejSMUAHuMwXrhGlltF3lw83+xAjnqsVp75kGS6OH61
 -----END RSA PRIVATE KEY-----`,
+  // The Actions runner sets all inputs to empty strings if not set.
+  "INPUT_PERMISSION-ADMINISTRATION": "",
 };

 export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
@@ -60,7 +63,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
  const owner = env.INPUT_OWNER ?? env.GITHUB_REPOSITORY_OWNER;
  const currentRepoName = env.GITHUB_REPOSITORY.split("/")[1];
  const repo = encodeURIComponent(
-    (env.INPUT_REPOSITORIES ?? currentRepoName).split(",")[0],
+    (env.INPUT_REPOSITORIES ?? currentRepoName).split(",")[0]
  );

  mockPool
@@ -76,7 +79,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
    .reply(
      200,
      { id: mockInstallationId, app_slug: mockAppSlug },
-      { headers: { "content-type": "application/json" } },
+      { headers: { "content-type": "application/json" } }
    );

  // Mock installation access token request
@@ -97,7 +100,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
    .reply(
      201,
      { token: mockInstallationAccessToken, expires_at: mockExpiresAt },
-      { headers: { "content-type": "application/json" } },
+      { headers: { "content-type": "application/json" } }
    );

  // Run the callback
@@ -7,6 +7,7 @@ process.env.STATE_token = "secret123";
 // inputs are set as environment variables with the prefix INPUT_
 // https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
 process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
+process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";

 // 1 hour in the future, not expired
 process.env.STATE_expiresAt = new Date(
@@ -7,6 +7,10 @@ process.env.STATE_token = "secret123";
 // 1 hour in the past, expired
 process.env.STATE_expiresAt = new Date(Date.now() - 1000 * 60 * 60).toISOString();

+// inputs are set as environment variables with the prefix INPUT_
+// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
+process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";
+
 const mockAgent = new MockAgent();

 setGlobalDispatcher(mockAgent);
@@ -7,6 +7,7 @@ process.env.STATE_token = "secret123";
 // inputs are set as environment variables with the prefix INPUT_
 // https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
 process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
+process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";

 // 1 hour in the future, not expired
 process.env.STATE_expiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();
@@ -2,4 +2,8 @@
 // https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
 delete process.env.STATE_token;

+// inputs are set as environment variables with the prefix INPUT_
+// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
+process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";
+
 await import("../post.js");
@@ -12,9 +12,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `app_id — 'app_id' is deprecated and will be removed in a future version. Use 'app-id' instead.␊
-    private_key — 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead.␊
-    skip_token_revoke — 'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead.`
+    ''

 ## main-custom-github-api-url.test.js

@@ -24,7 +22,9 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "create-github-app-token" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/create-github-app-token␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -39,16 +39,6 @@ Generated by [AVA](https://avajs.dev).
    POST /api/v3/app/installations/123456/access_tokens␊
    {"repositories":["create-github-app-token"]}`

-## main-missing-app-id.test.js
-
-> stderr
-
-    'Input required and not supplied: app-id'
-
-> stdout
-
-    ''
-
 ## main-missing-owner.test.js

 > stderr
@@ -59,16 +49,6 @@ Generated by [AVA](https://avajs.dev).

    ''

-## main-missing-private-key.test.js
-
-> stderr
-
-    'Input required and not supplied: private-key'
-
-> stdout
-
-    ''
-
 ## main-missing-repository.test.js

 > stderr
@@ -87,7 +67,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories not set, creating token for the current repository ("create-github-app-token")␊
+    `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -111,7 +91,9 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "failed-repo" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/failed-repo␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -135,7 +117,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `repositories not set, creating token for all repositories for given owner "smockle"␊
+    `Input 'repositories' is not set. Creating token for all repositories owned by smockle.␊
    Failed to create token for "smockle" (attempt 1): GitHub API not available␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
@@ -160,7 +142,9 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "failed-repo" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/failed-repo␊
    Failed to create token for "failed-repo" (attempt 1): GitHub API not available␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
@@ -185,7 +169,11 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "create-github-app-token,toolkit,checkout" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/create-github-app-token␊
+    - actions/toolkit␊
+    - actions/checkout␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -208,7 +196,11 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "create-github-app-token,toolkit,checkout" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/create-github-app-token␊
+    - actions/toolkit␊
+    - actions/checkout␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -231,7 +223,9 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories set, creating token for repositories "create-github-app-token" owned by "actions"␊
+    `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
+          ␊
+    - actions/create-github-app-token␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -254,7 +248,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `repositories not set, creating token for all repositories for given owner "actions"␊
+    `Input 'repositories' is not set. Creating token for all repositories owned by actions.␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -277,7 +271,8 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner not set, creating owner for given repositories "create-github-app-token" in current owner ("actions")␊
+    `No 'owner' input provided. Using default owner 'actions' to create token for the following repositories:␊
+    - actions/create-github-app-token␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -300,7 +295,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories not set, creating token for the current repository ("create-github-app-token")␊
+    `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
@@ -323,7 +318,7 @@ Generated by [AVA](https://avajs.dev).

 > stdout

-    `owner and repositories not set, creating token for the current repository ("create-github-app-token")␊
+    `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
    ␊
    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊