chore(main): release 3.2.0

feat: add support for enterprise-level GitHub Apps (#263 )
This pull request adds support for generating GitHub App installation tokens for enterprise-level installations. ### What changed - Added a new `enterprise` input to `action.yml`. - Wired `enterprise` through `main.js` and `lib/main.js`. - Added validation so `enterprise` cannot be combined with `owner` or `repositories`. - Implemented enterprise installation lookup using the direct GitHub API route `GET /enterprises/{enterprise}/installation`, then used the returned installation ID to mint an installation token through `@octokit/auth-app`. - Updated `README.md` with enterprise installation usage and input documentation. - Updated `dist/main.cjs` for the bundled action. - Shared token creation retry behavior across repository, owner, and enterprise paths so server errors and transient network errors are retried, while client errors fail immediately. ### Tests Added focused test coverage for: - enterprise token creation - enterprise token creation with explicit permissions - enterprise installation not found - mutual exclusivity with `owner` - mutual exclusivity with `repositories` - owner installation client errors are not retried - transient network errors are retried during token creation ### Notes - This keeps the existing repository-scoped token behavior unchanged. - Owner, repository, and enterprise token creation now share the same retry policy: server errors and recognized transient network errors are retried, while client errors fail immediately. This intentionally fixes the previous owner-path behavior that retried client errors. Refs: - https://github.blog/changelog/2025-07-01-enterprise-level-access-for-github-apps-and-installation-automation-apis/ - https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-an-enterprise-installation-for-the-authenticated-app --------- Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-05-08 18:56:39 +00:00 · 2026-05-08 11:56:11 -07:00 · 2026-05-07 19:09:31 -07:00 · 2026-05-07 18:58:55 -07:00 · 2026-05-07 18:13:10 -07:00 · 2026-04-21 09:56:11 -07:00
24 changed files with 856 additions and 303 deletions
@@ -1,17 +0,0 @@
-name: 'Publish Immutable Action'
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      packages: write
-    steps:
-      - uses: actions/checkout@v6
-      - name: Publish Immutable Action
-        uses: actions/publish-immutable-action@v0.0.4
@@ -1,6 +1,7 @@
 name: release

 on:
+  workflow_dispatch:
  push:
    branches:
      - "*.x"
@@ -17,24 +18,64 @@ jobs:
    name: release
    runs-on: ubuntu-latest
    steps:
-      # build local version to create token
      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false

-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
-
-      - run: npm ci
-      - run: npm run build
      - uses: ./
        id: app-token
        with:
          app-id: ${{ vars.RELEASER_APP_ID }}
          private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
-      # install release dependencies and release
-      - run: npm install --no-save @semantic-release/git semantic-release-plugin-github-breaking-version-tag
-      - run: npx semantic-release --debug
+
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release-please
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          config-file: ${{ github.ref_name == 'beta' && 'release-please-config.beta.json' || 'release-please-config.json' }}
+          manifest-file: .release-please-manifest.json
+          target-branch: ${{ github.ref_name }}
+
+      - uses: actions/checkout@v6
+        if: steps.release-please.outputs.prs_created == 'true'
+        with:
+          ref: ${{ fromJSON(steps.release-please.outputs.pr).headBranchName }}
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: actions/setup-node@v6
+        if: steps.release-please.outputs.prs_created == 'true'
+        with:
+          node-version-file: package.json
+
+      - run: npm ci
+        if: steps.release-please.outputs.prs_created == 'true'
+
+      - run: npm run build
+        if: steps.release-please.outputs.prs_created == 'true'
+
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        if: steps.release-please.outputs.prs_created == 'true'
+        with:
+          commit_author: "${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>"
+          commit_message: "chore: update dist files"
+          file_pattern: dist/**
+
+      - name: Update major version tag
+        id: update-major-tag
+        if: steps.release-please.outputs.release_created == 'true' && github.ref_name != 'beta'
+        uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
+        continue-on-error: true
+        with:
+          route: PATCH /repos/${{ github.repository }}/git/refs/tags/v${{ steps.release-please.outputs.major }}
+          sha: ${{ steps.release-please.outputs.sha }}
+          force: true
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Create major version tag
+        if: steps.release-please.outputs.release_created == 'true' && github.ref_name != 'beta' && steps.update-major-tag.outcome == 'failure'
+        uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
+        with:
+          route: POST /repos/${{ github.repository }}/git/refs
+          ref: refs/tags/v${{ steps.release-please.outputs.major }}
+          sha: ${{ steps.release-please.outputs.sha }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -1,3 +1,4 @@
 .env
 coverage
 node_modules/
+.DS_Store
@@ -0,0 +1,3 @@
+{
+  ".": "3.2.0"
+}
@@ -0,0 +1,13 @@
+# Changelog
+
+## [3.2.0](https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0) (2026-05-08)
+
+
+### Features
+
+* add support for enterprise-level GitHub Apps ([#263](https://github.com/actions/create-github-app-token/issues/263)) ([952a2a7](https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4))
+
+
+### Bug Fixes
+
+* **deps:** bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group ([#364](https://github.com/actions/create-github-app-token/issues/364)) ([43e5c34](https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857))
@@ -9,10 +9,10 @@ GitHub Action for creating a GitHub App installation access token.
 In order to use this action, you need to:

 1. [Register new GitHub App](https://docs.github.com/apps/creating-github-apps/setting-up-a-github-app/creating-a-github-app).
-2. [Store the App's Client ID in your repository environment variables](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows) (example: `GITHUB_APP_CLIENT_ID`).
-3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets?tool=webui#creating-secrets-for-a-repository) (example: `GITHUB_APP_PRIVATE_KEY`).
+2. [Store the App's Client ID in your repository variables](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_CLIENT_ID`).
+3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets?tool=webui#creating-secrets-for-a-repository) (example: `APP_PRIVATE_KEY`).

-> [!IMPORTANT]  
+> [!IMPORTANT]
 > An installation access token expires after 1 hour. Please [see this comment](https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796) for alternative approaches if you have long-running processes.

 ### Create a token for the current repository
@@ -31,8 +31,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: ./actions/staging-tests
        with:
          token: ${{ steps.app-token.outputs.token }}
@@ -51,8 +51,8 @@ jobs:
        id: app-token
        with:
          # required
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: actions/checkout@v6
        with:
          token: ${{ steps.app-token.outputs.token }}
@@ -77,8 +77,8 @@ jobs:
        id: app-token
        with:
          # required
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
@@ -102,8 +102,8 @@ jobs:
        id: app-token
        with:
          # required
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
@@ -138,8 +138,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - uses: peter-evans/create-or-update-comment@v4
        with:
@@ -160,8 +160,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: |
            repo1
@@ -185,8 +185,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: another-owner
      - uses: peter-evans/create-or-update-comment@v4
        with:
@@ -195,10 +195,32 @@ jobs:
          body: "Hello, World!"
 ```

+### Create a token for an enterprise installation
+
+```yaml
+on: [workflow_dispatch]
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          enterprise: my-enterprise-slug
+      - name: Call enterprise management REST API with gh
+        run: |
+          gh api /enterprises/my-enterprise-slug/apps/installable_organizations
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+```
+
 ### Create a token with specific permissions

 > [!NOTE]
-> Selected permissions must be granted to the installation of the specified app and repository owner. Setting a permission that the installation does not have will result in an error.
+> Selected permissions must be granted to the specified app installation. Setting a permission that the installation does not have will result in an error.

 ```yaml
 on: [issues]
@@ -210,8 +232,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          permission-issues: write
      - uses: peter-evans/create-or-update-comment@v4
@@ -252,8 +274,8 @@ jobs:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
-          client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ matrix.owners-and-repos.owner }}
          repositories: ${{ join(matrix.owners-and-repos.repos) }}
      - uses: octokit/request-action@v2.x
@@ -310,8 +332,8 @@ If you set `HTTP_PROXY` or `HTTPS_PROXY`, also set `NODE_USE_ENV_PROXY: "1"` on
    NO_PROXY: github.example.com
    NODE_USE_ENV_PROXY: "1"
  with:
-    client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
-    private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+    client-id: ${{ vars.APP_CLIENT_ID }}
+    private-key: ${{ secrets.APP_PRIVATE_KEY }}
 ```

 ## Inputs
@@ -334,14 +356,14 @@ steps:
  - name: Decode the GitHub App Private Key
    id: decode
    run: |
-      private_key=$(echo "${{ secrets.GITHUB_APP_PRIVATE_KEY }}" | base64 -d | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
+      private_key=$(echo "${{ secrets.APP_PRIVATE_KEY }}" | base64 -d | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
      echo "::add-mask::$private_key"
      echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
  - name: Generate GitHub App Token
    id: app-token
    uses: actions/create-github-app-token@v3
    with:
-      client-id: ${{ vars.GITHUB_APP_CLIENT_ID }}
+      client-id: ${{ vars.APP_CLIENT_ID }}
      private-key: ${{ steps.decode.outputs.private-key }}
 ```

@@ -356,6 +378,13 @@ steps:
 > [!NOTE]
 > If `owner` is set and `repositories` is empty, access will be scoped to all repositories in the provided repository owner's installation. If `owner` and `repositories` are empty, access will be scoped to only the current repository.

+### `enterprise`
+
+**Optional:** The slug of the enterprise account to generate a token for an enterprise installation.
+
+> [!NOTE]
+> The `enterprise` input is mutually exclusive with `owner` and `repositories`. Use it when the GitHub App is installed on an enterprise account. Enterprise installation tokens can call enterprise APIs, but do not grant organization or repository access.
+
 ### `permission-<permission name>`

 **Optional:** The permissions to grant to the token. By default, the token inherits all of the installation's permissions. We recommend to explicitly list the permissions that are required for a use case. This follows GitHub's own recommendation to [control permissions of `GITHUB_TOKEN` in workflows](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token). The documentation also lists all available permissions, just prefix the permission key with `permission-` (e.g., `pull-requests` → `permission-pull-requests`).
@@ -386,13 +415,14 @@ GitHub App slug.

 ## How it works

-The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app). By default,
+The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app).

-1. The token is scoped to the current repository or `repositories` if set.
-2. The token inherits all the installation's permissions.
-3. The token is set as output `token` which can be used in subsequent steps.
-4. Unless the `skip-token-revoke` input is set to true, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
-5. The token is masked, it cannot be logged accidentally.
+The token target depends on the inputs: `enterprise` creates a token for an enterprise installation, `owner` without `repositories` creates a token for all repositories in the owner's installation, `repositories` scopes the token to those repositories, and no target inputs scopes the token to the current repository.
+
+1. The token inherits all the installation's permissions.
+2. The token is set as output `token` which can be used in subsequent steps.
+3. Unless the `skip-token-revoke` input is set to true, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
+4. The token is masked, it cannot be logged accidentally.

 > [!NOTE]
 > Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.
@@ -21,6 +21,9 @@ inputs:
  repositories:
    description: "Comma or newline-separated list of repositories to install the GitHub App on (defaults to current repository if owner is unset)"
    required: false
+  enterprise:
+    description: "The slug of the enterprise account where the GitHub App is installed (cannot be used with 'owner' or 'repositories')"
+    required: false
  skip-token-revoke:
    description: "If true, the token will not be revoked when the current job is complete"
    required: false
@@ -22985,7 +22985,7 @@ function isNetworkError(error2) {
    return false;
  }
  const { message, stack } = error2;
-  if (message === "Load failed") {
+  if (message === "Load failed" || message.startsWith("Load failed (") && message.endsWith(")")) {
    return stack === void 0 || "__sentry_captured__" in error2;
  }
  if (message.startsWith("error sending request for url")) {
@@ -23196,80 +23196,20 @@ async function pRetry(input, options = {}) {
 }

 // lib/main.js
-async function main(clientId, privateKey, owner, repositories, permissions, core, createAppAuth2, request2, skipTokenRevoke) {
-  let parsedOwner = "";
-  let parsedRepositoryNames = [];
-  if (!owner && repositories.length === 0) {
-    const [owner2, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
-    parsedOwner = owner2;
-    parsedRepositoryNames = [repo];
-    core.info(
-      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner2}/${repo}).`
-    );
-  }
-  if (owner && repositories.length === 0) {
-    parsedOwner = owner;
-    core.info(
-      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
-    );
-  }
-  if (!owner && repositories.length > 0) {
-    parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
-    parsedRepositoryNames = repositories;
-    core.info(
-      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories.map((repo) => `
- ${parsedOwner}/${repo}`).join("")}`
-    );
-  }
-  if (owner && repositories.length > 0) {
-    parsedOwner = owner;
-    parsedRepositoryNames = repositories;
-    core.info(
-      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      ${repositories.map((repo) => `
- ${parsedOwner}/${repo}`).join("")}`
-    );
+async function main(clientId, privateKey, enterprise, owner, repositories, permissions, core, createAppAuth2, request2, skipTokenRevoke) {
+  if (enterprise && (owner || repositories.length > 0)) {
+    throw new Error("Cannot use 'enterprise' input with 'owner' or 'repositories' inputs");
  }
+  const target = resolveInstallationTarget(enterprise, owner, repositories, core);
  const auth5 = createAppAuth2({
    appId: clientId,
    privateKey,
    request: request2
  });
-  let authentication, installationId, appSlug;
-  if (parsedRepositoryNames.length > 0) {
-    ({ authentication, installationId, appSlug } = await pRetry(
-      () => getTokenFromRepository(
-        request2,
-        auth5,
-        parsedOwner,
-        parsedRepositoryNames,
-        permissions
-      ),
-      {
-        shouldRetry: ({ error: error2 }) => error2.status >= 500,
-        onFailedAttempt: (context) => {
-          core.info(
-            `Failed to create token for "${parsedRepositoryNames.join(
-              ","
-            )}" (attempt ${context.attemptNumber}): ${context.error.message}`
-          );
-        },
-        retries: 3
-      }
-    ));
-  } else {
-    ({ authentication, installationId, appSlug } = await pRetry(
-      () => getTokenFromOwner(request2, auth5, parsedOwner, permissions),
-      {
-        onFailedAttempt: (context) => {
-          core.info(
-            `Failed to create token for "${parsedOwner}" (attempt ${context.attemptNumber}): ${context.error.message}`
-          );
-        },
-        retries: 3
-      }
-    ));
-  }
+  const { authentication, installationId, appSlug } = await pRetry(
+    () => getTokenFromTarget(request2, auth5, target, permissions),
+    createTokenRetryOptions(core, getTokenRetryDescription(target))
+  );
  core.setSecret(authentication.token);
  core.setOutput("token", authentication.token);
  core.setOutput("installation-id", installationId);
@@ -23279,6 +23219,102 @@ async function main(clientId, privateKey, owner, repositories, permissions, core
    core.saveState("expiresAt", authentication.expiresAt);
  }
 }
+function resolveInstallationTarget(enterprise, owner, repositories, core) {
+  if (enterprise) {
+    core.info(`Creating enterprise installation token for enterprise "${enterprise}".`);
+    return { type: "enterprise", enterprise };
+  }
+  if (!owner && repositories.length === 0) {
+    const [defaultOwner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
+    core.info(
+      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${defaultOwner}/${repo}).`
+    );
+    return {
+      type: "repository",
+      owner: defaultOwner,
+      repositories: [repo]
+    };
+  }
+  if (owner && repositories.length === 0) {
+    core.info(
+      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
+    );
+    return { type: "owner", owner };
+  }
+  const parsedOwner = owner || String(process.env.GITHUB_REPOSITORY_OWNER);
+  if (!owner) {
+    core.info(
+      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories.map((repo) => `
+- ${parsedOwner}/${repo}`).join("")}`
+    );
+  } else {
+    core.info(
+      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:${repositories.map((repo) => `
+- ${parsedOwner}/${repo}`).join("")}`
+    );
+  }
+  return {
+    type: "repository",
+    owner: parsedOwner,
+    repositories
+  };
+}
+function getTokenRetryDescription(target) {
+  switch (target.type) {
+    case "enterprise":
+      return `enterprise "${target.enterprise}"`;
+    case "repository":
+      return `"${target.repositories.map((repository) => `${target.owner}/${repository}`).join(",")}"`;
+    case "owner":
+      return `"${target.owner}"`;
+    /* c8 ignore next 2 */
+    default:
+      throw new Error(`Unsupported installation target type: ${target.type}`);
+  }
+}
+function getTokenFromTarget(request2, auth5, target, permissions) {
+  switch (target.type) {
+    case "enterprise":
+      return getTokenFromEnterprise(request2, auth5, target.enterprise, permissions);
+    case "repository":
+      return getTokenFromRepository(
+        request2,
+        auth5,
+        target.owner,
+        target.repositories,
+        permissions
+      );
+    case "owner":
+      return getTokenFromOwner(request2, auth5, target.owner, permissions);
+    /* c8 ignore next 2 */
+    default:
+      throw new Error(`Unsupported installation target type: ${target.type}`);
+  }
+}
+function createTokenRetryOptions(core, targetDescription) {
+  return {
+    shouldRetry: ({ error: error2 }) => error2.status >= 500 || isNetworkError(error2),
+    onFailedAttempt: (context) => {
+      core.info(
+        `Failed to create token for ${targetDescription} (attempt ${context.attemptNumber}): ${context.error.message}`
+      );
+    },
+    retries: 3
+  };
+}
+async function createInstallationAuthResult(auth5, installation, permissions, options = {}) {
+  const authentication = await auth5({
+    type: "installation",
+    installationId: installation.id,
+    permissions,
+    ...options
+  });
+  return {
+    authentication,
+    installationId: installation.id,
+    appSlug: installation["app_slug"]
+  };
+}
 async function getTokenFromOwner(request2, auth5, parsedOwner, permissions) {
  const response = await request2("GET /users/{username}/installation", {
    username: parsedOwner,
@@ -23286,14 +23322,7 @@ async function getTokenFromOwner(request2, auth5, parsedOwner, permissions) {
      hook: auth5.hook
    }
  });
-  const authentication = await auth5({
-    type: "installation",
-    installationId: response.data.id,
-    permissions
-  });
-  const installationId = response.data.id;
-  const appSlug = response.data["app_slug"];
-  return { authentication, installationId, appSlug };
+  return createInstallationAuthResult(auth5, response.data, permissions);
 }
 async function getTokenFromRepository(request2, auth5, parsedOwner, parsedRepositoryNames, permissions) {
  const response = await request2("GET /repos/{owner}/{repo}/installation", {
@@ -23303,15 +23332,28 @@ async function getTokenFromRepository(request2, auth5, parsedOwner, parsedReposi
      hook: auth5.hook
    }
  });
-  const authentication = await auth5({
-    type: "installation",
-    installationId: response.data.id,
-    repositoryNames: parsedRepositoryNames,
-    permissions
+  return createInstallationAuthResult(auth5, response.data, permissions, {
+    repositoryNames: parsedRepositoryNames
  });
-  const installationId = response.data.id;
-  const appSlug = response.data["app_slug"];
-  return { authentication, installationId, appSlug };
+}
+async function getTokenFromEnterprise(request2, auth5, enterprise, permissions) {
+  let response;
+  try {
+    response = await request2("GET /enterprises/{enterprise}/installation", {
+      enterprise,
+      request: {
+        hook: auth5.hook
+      }
+    });
+  } catch (error2) {
+    if (error2.status === 404) {
+      throw new Error(
+        `No enterprise installation found matching the enterprise slug "${enterprise}".`
+      );
+    }
+    throw error2;
+  }
+  return createInstallationAuthResult(auth5, response.data, permissions);
 }

 // lib/request.js
@@ -23352,9 +23394,10 @@ async function run() {
  ensureNativeProxySupport();
  const clientId = getInput("client-id") || getInput("app-id");
  if (!clientId) {
-    throw new Error("Either 'client-id' or 'app-id' input must be set");
+    throw new Error("The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.");
  }
  const privateKey = getInput("private-key");
+  const enterprise = getInput("enterprise");
  const owner = getInput("owner");
  const repositories = getInput("repositories").split(/[\n,]+/).map((s) => s.trim()).filter((x) => x !== "");
  const skipTokenRevoke = getBooleanInput("skip-token-revoke");
@@ -23362,6 +23405,7 @@ async function run() {
  return main(
    clientId,
    privateKey,
+    enterprise,
    owner,
    repositories,
    permissions,
@@ -1,9 +1,11 @@
 import pRetry from "p-retry";
+import isNetworkError from "is-network-error";
 // @ts-check

 /**
 * @param {string} clientId
 * @param {string} privateKey
+ * @param {string} enterprise
 * @param {string} owner
 * @param {string[]} repositories
 * @param {undefined | Record<string, string>} permissions
@@ -15,59 +17,21 @@ import pRetry from "p-retry";
 export async function main(
  clientId,
  privateKey,
+  enterprise,
  owner,
  repositories,
  permissions,
  core,
  createAppAuth,
  request,
-  skipTokenRevoke
+  skipTokenRevoke,
 ) {
-  let parsedOwner = "";
-  let parsedRepositoryNames = [];
-
-  // If neither owner nor repositories are set, default to current repository
-  if (!owner && repositories.length === 0) {
-    const [owner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
-    parsedOwner = owner;
-    parsedRepositoryNames = [repo];
-
-    core.info(
-      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner}/${repo}).`
-    );
+  // Validate mutual exclusivity of enterprise with owner/repositories
+  if (enterprise && (owner || repositories.length > 0)) {
+    throw new Error("Cannot use 'enterprise' input with 'owner' or 'repositories' inputs");
  }

-  // If only an owner is set, default to all repositories from that owner
-  if (owner && repositories.length === 0) {
-    parsedOwner = owner;
-
-    core.info(
-      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
-    );
-  }
-
-  // If repositories are set, but no owner, default to `GITHUB_REPOSITORY_OWNER`
-  if (!owner && repositories.length > 0) {
-    parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
-    parsedRepositoryNames = repositories;
-
-    core.info(
-      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
-        .map((repo) => `\n- ${parsedOwner}/${repo}`)
-        .join("")}`
-    );
-  }
-
-  // If both owner and repositories are set, use those values
-  if (owner && repositories.length > 0) {
-    parsedOwner = owner;
-    parsedRepositoryNames = repositories;
-
-    core.info(
-      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      ${repositories.map((repo) => `\n- ${parsedOwner}/${repo}`).join("")}`
-    );
-  }
+  const target = resolveInstallationTarget(enterprise, owner, repositories, core);

  const auth = createAppAuth({
    appId: clientId,
@@ -75,45 +39,10 @@ export async function main(
    request,
  });

-  let authentication, installationId, appSlug;
-  // If at least one repository is set, get installation ID from that repository
-
-  if (parsedRepositoryNames.length > 0) {
-    ({ authentication, installationId, appSlug } = await pRetry(
-      () =>
-        getTokenFromRepository(
-          request,
-          auth,
-          parsedOwner,
-          parsedRepositoryNames,
-          permissions
-        ),
-      {
-        shouldRetry: ({ error }) => error.status >= 500,
-        onFailedAttempt: (context) => {
-          core.info(
-            `Failed to create token for "${parsedRepositoryNames.join(
-              ","
-            )}" (attempt ${context.attemptNumber}): ${context.error.message}`
-          );
-        },
-        retries: 3,
-      }
-    ));
-  } else {
-    // Otherwise get the installation for the owner, which can either be an organization or a user account
-    ({ authentication, installationId, appSlug } = await pRetry(
-      () => getTokenFromOwner(request, auth, parsedOwner, permissions),
-      {
-        onFailedAttempt: (context) => {
-          core.info(
-            `Failed to create token for "${parsedOwner}" (attempt ${context.attemptNumber}): ${context.error.message}`
-          );
-        },
-        retries: 3,
-      }
-    ));
-  }
+  const { authentication, installationId, appSlug } = await pRetry(
+    () => getTokenFromTarget(request, auth, target, permissions),
+    createTokenRetryOptions(core, getTokenRetryDescription(target))
+  );

  // Register the token with the runner as a secret to ensure it is masked in logs
  core.setSecret(authentication.token);
@@ -129,6 +58,125 @@ export async function main(
  }
 }

+function resolveInstallationTarget(enterprise, owner, repositories, core) {
+  if (enterprise) {
+    core.info(`Creating enterprise installation token for enterprise "${enterprise}".`);
+    return { type: "enterprise", enterprise };
+  }
+
+  if (!owner && repositories.length === 0) {
+    const [defaultOwner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
+
+    core.info(
+      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${defaultOwner}/${repo}).`
+    );
+
+    return {
+      type: "repository",
+      owner: defaultOwner,
+      repositories: [repo],
+    };
+  }
+
+  if (owner && repositories.length === 0) {
+    core.info(
+      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
+    );
+
+    return { type: "owner", owner };
+  }
+
+  const parsedOwner = owner || String(process.env.GITHUB_REPOSITORY_OWNER);
+
+  if (!owner) {
+    core.info(
+      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
+        .map((repo) => `\n- ${parsedOwner}/${repo}`)
+        .join("")}`
+    );
+  } else {
+    core.info(
+      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:${repositories
+        .map((repo) => `\n- ${parsedOwner}/${repo}`)
+        .join("")}`
+    );
+  }
+
+  return {
+    type: "repository",
+    owner: parsedOwner,
+    repositories,
+  };
+}
+
+function getTokenRetryDescription(target) {
+  switch (target.type) {
+    case "enterprise":
+      return `enterprise "${target.enterprise}"`;
+    case "repository":
+      return `"${target.repositories
+        .map((repository) => `${target.owner}/${repository}`)
+        .join(",")}"`;
+    case "owner":
+      return `"${target.owner}"`;
+    /* c8 ignore next 2 */
+    default:
+      throw new Error(`Unsupported installation target type: ${target.type}`);
+  }
+}
+
+function getTokenFromTarget(request, auth, target, permissions) {
+  switch (target.type) {
+    case "enterprise":
+      return getTokenFromEnterprise(request, auth, target.enterprise, permissions);
+    case "repository":
+      return getTokenFromRepository(
+        request,
+        auth,
+        target.owner,
+        target.repositories,
+        permissions
+      );
+    case "owner":
+      return getTokenFromOwner(request, auth, target.owner, permissions);
+    /* c8 ignore next 2 */
+    default:
+      throw new Error(`Unsupported installation target type: ${target.type}`);
+  }
+}
+
+function createTokenRetryOptions(core, targetDescription) {
+  return {
+    shouldRetry: ({ error }) => error.status >= 500 || isNetworkError(error),
+    onFailedAttempt: (context) => {
+      core.info(
+        `Failed to create token for ${targetDescription} (attempt ${context.attemptNumber}): ${context.error.message}`
+      );
+    },
+    retries: 3,
+  };
+}
+
+async function createInstallationAuthResult(
+  auth,
+  installation,
+  permissions,
+  options = {},
+) {
+  const authentication = await auth({
+    type: "installation",
+    installationId: installation.id,
+    permissions,
+    ...options,
+  });
+
+  return {
+    authentication,
+    installationId: installation.id,
+    appSlug: installation["app_slug"],
+  };
+}
+
 async function getTokenFromOwner(request, auth, parsedOwner, permissions) {
  // https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#get-a-user-installation-for-the-authenticated-app
  // This endpoint works for both users and organizations
@@ -139,17 +187,8 @@ async function getTokenFromOwner(request, auth, parsedOwner, permissions) {
    },
  });

-  // Get token for for all repositories of the given installation
-  const authentication = await auth({
-    type: "installation",
-    installationId: response.data.id,
-    permissions,
-  });
-
-  const installationId = response.data.id;
-  const appSlug = response.data["app_slug"];
-
-  return { authentication, installationId, appSlug };
+  // Get token for all repositories of the given installation
+  return createInstallationAuthResult(auth, response.data, permissions);
 }

 async function getTokenFromRepository(
@@ -169,15 +208,30 @@ async function getTokenFromRepository(
  });

  // Get token for given repositories
-  const authentication = await auth({
-    type: "installation",
-    installationId: response.data.id,
+  return createInstallationAuthResult(auth, response.data, permissions, {
    repositoryNames: parsedRepositoryNames,
-    permissions,
  });
-
-  const installationId = response.data.id;
-  const appSlug = response.data["app_slug"];
-
-  return { authentication, installationId, appSlug };
+}
+
+async function getTokenFromEnterprise(request, auth, enterprise, permissions) {
+  let response;
+  try {
+    response = await request("GET /enterprises/{enterprise}/installation", {
+      enterprise,
+      request: {
+        hook: auth.hook,
+      },
+    });
+  } catch (error) {
+    if (error.status === 404) {
+      throw new Error(
+        `No enterprise installation found matching the enterprise slug "${enterprise}".`
+      );
+    }
+
+    throw error;
+  }
+
+  // Get token for the enterprise installation
+  return createInstallationAuthResult(auth, response.data, permissions);
 }
@@ -20,9 +20,10 @@ async function run() {

  const clientId = core.getInput("client-id") || core.getInput("app-id");
  if (!clientId) {
-    throw new Error("Either 'client-id' or 'app-id' input must be set");
+    throw new Error("The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.");
  }
  const privateKey = core.getInput("private-key");
+  const enterprise = core.getInput("enterprise");
  const owner = core.getInput("owner");
  const repositories = core
    .getInput("repositories")
@@ -37,6 +38,7 @@ async function run() {
  return main(
    clientId,
    privateKey,
+    enterprise,
    owner,
    repositories,
    permissions,
@@ -1,17 +1,18 @@
 {
  "name": "create-github-app-token",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "create-github-app-token",
-      "version": "3.1.0",
+      "version": "3.2.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^3.0.0",
+        "@actions/core": "^3.0.1",
        "@octokit/auth-app": "^8.2.0",
        "@octokit/request": "^10.0.8",
+        "is-network-error": "^1.3.2",
        "p-retry": "^8.0.0"
      },
      "devDependencies": {
@@ -27,9 +28,9 @@
      }
    },
    "node_modules/@actions/core": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
-      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
+      "integrity": "sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==",
      "license": "MIT",
      "dependencies": {
        "@actions/exec": "^3.0.0",
@@ -1252,9 +1253,9 @@
      }
    },
    "node_modules/is-network-error": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.1.tgz",
-      "integrity": "sha512-6QCxa49rQbmUWLfk0nuGqzql9U8uaV2H6279bRErPBHe/109hCzsLUBUHfbEtvLIHBd6hyXbgedBSHevm43Edw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz",
+      "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==",
      "license": "MIT",
      "engines": {
        "node": ">=16"
@@ -2,7 +2,7 @@
  "name": "create-github-app-token",
  "private": true,
  "type": "module",
-  "version": "3.1.0",
+  "version": "3.2.0",
  "description": "GitHub Action for creating a GitHub App Installation Access Token",
  "engines": {
    "node": ">=24.4.0"
@@ -16,9 +16,10 @@
  },
  "license": "MIT",
  "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^3.0.1",
    "@octokit/auth-app": "^8.2.0",
    "@octokit/request": "^10.0.8",
+    "is-network-error": "^1.3.2",
    "p-retry": "^8.0.0"
  },
  "devDependencies": {
@@ -28,33 +29,5 @@
    "open-cli": "^9.0.0",
    "undici": "^7.24.6",
    "yaml": "^2.8.3"
-  },
-  "release": {
-    "branches": [
-      "+([0-9]).x",
-      "main",
-      {
-        "name": "beta",
-        "prerelease": true
-      }
-    ],
-    "plugins": [
-      "@semantic-release/commit-analyzer",
-      "@semantic-release/release-notes-generator",
-      "@semantic-release/github",
-      "@semantic-release/npm",
-      "semantic-release-plugin-github-breaking-version-tag",
-      [
-        "@semantic-release/git",
-        {
-          "assets": [
-            "package.json",
-            "package-lock.json",
-            "dist/*"
-          ],
-          "message": "build(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-        }
-      ]
-    ]
  }
 }
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "prerelease": true,
+      "prerelease-type": "beta",
+      "include-component-in-tag": false,
+      "release-type": "node",
+      "versioning": "prerelease"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "include-component-in-tag": false,
+      "release-type": "node"
+    }
+  }
+}
@@ -11,6 +11,13 @@ snapshot.setDefaultSnapshotSerializers([
  (value) => (typeof value === "string" ? value : undefined),
 ]);

+function normalizeStderr(stderr) {
+  return stderr
+    .replaceAll(/\u001B\[[0-9;]*m/g, "")
+    .replaceAll(process.cwd(), "<cwd>")
+    .replaceAll(/:\d+:\d+/g, ":<line>:<column>");
+}
+
 // Get all files in tests directory
 const files = readdirSync("tests");

@@ -39,10 +46,19 @@ for (const file of testFiles) {
      NODE_USE_ENV_PROXY,
      ...env
    } = process.env;
-    const { stderr, stdout } = await execFileAsync("node", [`tests/${file}`], {
-      env,
-    });
-    const trimmedStderr = stderr.replace(/\r?\n$/, "");
+    let stderr, stdout;
+    try {
+      ({ stderr, stdout } = await execFileAsync("node", [`tests/${file}`], {
+        env,
+      }));
+    } catch (error) {
+      if (!(error instanceof Error) || !("stderr" in error) || !("stdout" in error)) {
+        throw error;
+      }
+
+      ({ stderr, stdout } = error);
+    }
+    const trimmedStderr = normalizeStderr(stderr).replace(/\r?\n$/, "");
    const trimmedStdout = stdout.replace(/\r?\n$/, "");
    await t.test("stderr", (t) => {
      if (trimmedStderr) t.assert.snapshot(trimmedStderr);
@@ -38,7 +38,6 @@ POST /app/installations/123456/access_tokens

 exports[`main-custom-github-api-url.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/create-github-app-token
 ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a

@@ -55,12 +54,111 @@ POST /api/v3/app/installations/123456/access_tokens
 {"repositories":["create-github-app-token"]}
 `;

+exports[`main-enterprise-fail-response.test.js > stdout 1`] = `
+Creating enterprise installation token for enterprise "test-enterprise".
+Failed to create token for enterprise "test-enterprise" (attempt 1): GitHub API not available
+::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=installation-id::123456
+
+::set-output name=app-slug::github-actions
+::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+::save-state name=expiresAt::2016-07-11T22:14:10Z
+--- REQUESTS ---
+GET /enterprises/test-enterprise/installation
+GET /enterprises/test-enterprise/installation
+POST /app/installations/123456/access_tokens
+null
+`;
+
+exports[`main-enterprise-installation-not-found.test.js > stderr 1`] = `
+Error: No enterprise installation found matching the enterprise slug "test-enterprise".
+    at getTokenFromEnterprise (file://<cwd>/lib/main.js:<line>:<column>)
+    at process.processTicksAndRejections (node:internal/process/task_queues:<line>:<column>)
+    at async pRetry (file://<cwd>/node_modules/p-retry/index.js:<line>:<column>)
+    at async main (file://<cwd>/lib/main.js:<line>:<column>)
+    at async test (file://<cwd>/tests/main.js:<line>:<column>)
+    at async file://<cwd>/tests/main-enterprise-installation-not-found.test.js:<line>:<column>
+`;
+
+exports[`main-enterprise-installation-not-found.test.js > stdout 1`] = `
+Creating enterprise installation token for enterprise "test-enterprise".
+Failed to create token for enterprise "test-enterprise" (attempt 1): No enterprise installation found matching the enterprise slug "test-enterprise".
+::error::No enterprise installation found matching the enterprise slug "test-enterprise".
+--- REQUESTS ---
+GET /enterprises/test-enterprise/installation
+`;
+
+exports[`main-enterprise-mutual-exclusivity-owner.test.js > stderr 1`] = `
+Error: Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
+    at main (file://<cwd>/lib/main.js:<line>:<column>)
+    at run (file://<cwd>/main.js:<line>:<column>)
+    at file://<cwd>/main.js:<line>:<column>
+    at ModuleJob.run (node:internal/modules/esm/module_job:<line>:<column>)
+    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:<line>:<column>)
+    at async file://<cwd>/tests/main-enterprise-mutual-exclusivity-owner.test.js:<line>:<column>
+`;
+
+exports[`main-enterprise-mutual-exclusivity-owner.test.js > stdout 1`] = `
+::error::Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
+`;
+
+exports[`main-enterprise-mutual-exclusivity-repositories.test.js > stderr 1`] = `
+Error: Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
+    at main (file://<cwd>/lib/main.js:<line>:<column>)
+    at run (file://<cwd>/main.js:<line>:<column>)
+    at file://<cwd>/main.js:<line>:<column>
+    at ModuleJob.run (node:internal/modules/esm/module_job:<line>:<column>)
+    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:<line>:<column>)
+    at async file://<cwd>/tests/main-enterprise-mutual-exclusivity-repositories.test.js:<line>:<column>
+`;
+
+exports[`main-enterprise-mutual-exclusivity-repositories.test.js > stdout 1`] = `
+::error::Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
+`;
+
+exports[`main-enterprise-only-success.test.js > stdout 1`] = `
+Creating enterprise installation token for enterprise "test-enterprise".
+::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=installation-id::123456
+
+::set-output name=app-slug::github-actions
+::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+::save-state name=expiresAt::2016-07-11T22:14:10Z
+--- REQUESTS ---
+GET /enterprises/test-enterprise/installation
+POST /app/installations/123456/access_tokens
+null
+`;
+
+exports[`main-enterprise-token-permissions-set.test.js > stdout 1`] = `
+Creating enterprise installation token for enterprise "test-enterprise".
+::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=installation-id::123456
+
+::set-output name=app-slug::github-actions
+::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+::save-state name=expiresAt::2016-07-11T22:14:10Z
+--- REQUESTS ---
+GET /enterprises/test-enterprise/installation
+POST /app/installations/123456/access_tokens
+{"permissions":{"enterprise_custom_properties_for_organizations":"read"}}
+`;
+
 exports[`main-missing-client-and-app-id.test.js > stderr 1`] = `
-Either 'client-id' or 'app-id' input must be set
+The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
 `;

 exports[`main-missing-client-and-app-id.test.js > stdout 1`] = `
-::error::Either 'client-id' or 'app-id' input must be set
+::error::The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
 `;

 exports[`main-missing-owner.test.js > stderr 1`] = `
@@ -103,7 +201,6 @@ exports[`main-repo-skew.test.js > stderr 1`] = `

 exports[`main-repo-skew.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/failed-repo
 ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a

@@ -121,6 +218,45 @@ POST /app/installations/123456/access_tokens
 {"repositories":["failed-repo"]}
 `;

+exports[`main-token-get-owner-set-client-error.test.js > stderr 1`] = `
+RequestError [HttpError]: Forbidden
+    at fetchWrapper (file://<cwd>/node_modules/@octokit/request/dist-bundle/index.js:<line>:<column>)
+    at process.processTicksAndRejections (node:internal/process/task_queues:<line>:<column>)
+    at async hook (file://<cwd>/node_modules/@octokit/auth-app/dist-node/index.js:<line>:<column>)
+    at async getTokenFromOwner (file://<cwd>/lib/main.js:<line>:<column>)
+    at async pRetry (file://<cwd>/node_modules/p-retry/index.js:<line>:<column>)
+    at async main (file://<cwd>/lib/main.js:<line>:<column>)
+    at async test (file://<cwd>/tests/main.js:<line>:<column>)
+    at async file://<cwd>/tests/main-token-get-owner-set-client-error.test.js:<line>:<column> {
+  status: 403,
+  request: {
+    method: 'GET',
+    url: 'https://api.github.com/users/smockle/installation',
+    headers: {
+      accept: 'application/vnd.github.v3+json',
+      'user-agent': 'actions/create-github-app-token',
+      authorization: 'bearer [REDACTED]'
+    },
+    request: { hook: [Function: bound hook] AsyncFunction }
+  },
+  response: {
+    url: 'https://api.github.com/users/smockle/installation',
+    status: 403,
+    headers: { 'content-type': 'application/json' },
+    data: { message: 'Forbidden' }
+  },
+  [cause]: undefined
+}
+`;
+
+exports[`main-token-get-owner-set-client-error.test.js > stdout 1`] = `
+Input 'repositories' is not set. Creating token for all repositories owned by smockle.
+Failed to create token for "smockle" (attempt 1): Forbidden
+::error::Forbidden
+--- REQUESTS ---
+GET /users/smockle/installation
+`;
+
 exports[`main-token-get-owner-set-fail-response.test.js > stdout 1`] = `
 Input 'repositories' is not set. Creating token for all repositories owned by smockle.
 Failed to create token for "smockle" (attempt 1): GitHub API not available
@@ -142,9 +278,8 @@ null

 exports[`main-token-get-owner-set-repo-fail-response.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/failed-repo
-Failed to create token for "failed-repo" (attempt 1): GitHub API not available
+Failed to create token for "actions/failed-repo" (attempt 1): GitHub API not available
 ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a

 ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
@@ -161,9 +296,28 @@ POST /app/installations/123456/access_tokens
 {"repositories":["failed-repo"]}
 `;

+exports[`main-token-get-owner-set-repo-network-error.test.js > stdout 1`] = `
+Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
+- actions/network-repo
+Failed to create token for "actions/network-repo" (attempt 1): fetch failed
+::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+
+::set-output name=installation-id::123456
+
+::set-output name=app-slug::github-actions
+::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
+::save-state name=expiresAt::2016-07-11T22:14:10Z
+--- REQUESTS ---
+GET /repos/actions/network-repo/installation
+GET /repos/actions/network-repo/installation
+POST /app/installations/123456/access_tokens
+{"repositories":["network-repo"]}
+`;
+
 exports[`main-token-get-owner-set-repo-set-to-many-newline.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/create-github-app-token
 - actions/toolkit
 - actions/checkout
@@ -184,7 +338,6 @@ POST /app/installations/123456/access_tokens

 exports[`main-token-get-owner-set-repo-set-to-many.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/create-github-app-token
 - actions/toolkit
 - actions/checkout
@@ -205,7 +358,6 @@ POST /app/installations/123456/access_tokens

 exports[`main-token-get-owner-set-repo-set-to-one.test.js > stdout 1`] = `
 Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      
 - actions/create-github-app-token
 ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a

@@ -0,0 +1,39 @@
+import { test } from "./main.js";
+
+// Verify enterprise installation lookup retries when the GitHub API returns a 500 error.
+await test((mockPool) => {
+  process.env.INPUT_ENTERPRISE = "test-enterprise";
+  delete process.env.INPUT_OWNER;
+  delete process.env.INPUT_REPOSITORIES;
+
+  const mockInstallationId = "123456";
+  const mockAppSlug = "github-actions";
+
+  mockPool
+    .intercept({
+      path: "/enterprises/test-enterprise/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(500, "GitHub API not available");
+
+  mockPool
+    .intercept({
+      path: "/enterprises/test-enterprise/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      200,
+      { id: mockInstallationId, app_slug: mockAppSlug },
+      { headers: { "content-type": "application/json" } },
+    );
+});
@@ -0,0 +1,25 @@
+import { test } from "./main.js";
+
+// Verify `main` handles when no enterprise installation is found.
+await test((mockPool) => {
+  delete process.env.INPUT_OWNER;
+  delete process.env.INPUT_REPOSITORIES;
+  process.env.INPUT_ENTERPRISE = "test-enterprise";
+
+  // Mock the enterprise installation endpoint to return no matching installation
+  mockPool
+    .intercept({
+      path: "/enterprises/test-enterprise/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      404,
+      { message: "Not Found" },
+      { headers: { "content-type": "application/json" } }
+    );
+});
@@ -0,0 +1,13 @@
+import { DEFAULT_ENV } from "./main.js";
+
+// Verify `main` exits with an error when `enterprise` is used with `owner` input.
+// Set up environment with enterprise and owner set
+for (const [key, value] of Object.entries(DEFAULT_ENV)) {
+  process.env[key] = value;
+}
+
+process.env.INPUT_ENTERPRISE = "test-enterprise";
+process.env.INPUT_OWNER = "test-owner";
+
+const { default: promise } = await import("../main.js");
+await promise;
@@ -0,0 +1,13 @@
+import { DEFAULT_ENV } from "./main.js";
+
+// Verify `main` exits with an error when `enterprise` is used with `repositories` input.
+// Set up environment with enterprise and repositories set
+for (const [key, value] of Object.entries(DEFAULT_ENV)) {
+  process.env[key] = value;
+}
+
+process.env.INPUT_ENTERPRISE = "test-enterprise";
+process.env.INPUT_REPOSITORIES = "repo1,repo2";
+
+const { default: promise } = await import("../main.js");
+await promise;
@@ -0,0 +1,30 @@
+import { test } from "./main.js";
+
+// Verify `main` successfully obtains a token when only the `enterprise` input is set.
+await test((mockPool) => {
+  process.env.INPUT_ENTERPRISE = "test-enterprise";
+  delete process.env.INPUT_OWNER;
+  delete process.env.INPUT_REPOSITORIES;
+
+  // Mock the enterprise installation endpoint
+  const mockInstallationId = "123456";
+  const mockAppSlug = "github-actions";
+  mockPool
+    .intercept({
+      path: "/enterprises/test-enterprise/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      200,
+      {
+        id: mockInstallationId,
+        app_slug: mockAppSlug,
+      },
+      { headers: { "content-type": "application/json" } }
+    );
+});
@@ -0,0 +1,34 @@
+import { test } from "./main.js";
+
+// Use a declared enterprise permission from the generated schema to verify
+// enterprise token requests forward permission inputs to token creation.
+await test((mockPool) => {
+  process.env.INPUT_ENTERPRISE = "test-enterprise";
+  delete process.env.INPUT_OWNER;
+  delete process.env.INPUT_REPOSITORIES;
+  process.env[
+    "INPUT_PERMISSION-ENTERPRISE-CUSTOM-PROPERTIES-FOR-ORGANIZATIONS"
+  ] = "read";
+
+  // Mock the enterprise installation endpoint
+  const mockInstallationId = "123456";
+  const mockAppSlug = "github-actions";
+  mockPool
+    .intercept({
+      path: "/enterprises/test-enterprise/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      200,
+      {
+        id: mockInstallationId,
+        app_slug: mockAppSlug,
+      },
+      { headers: { "content-type": "application/json" } }
+    );
+});
@@ -0,0 +1,23 @@
+import { test } from "./main.js";
+
+// Verify client errors are not retried when getting a token for a user or organization.
+await test((mockPool) => {
+  process.env.INPUT_OWNER = "smockle";
+  delete process.env.INPUT_REPOSITORIES;
+
+  mockPool
+    .intercept({
+      path: "/users/smockle/installation",
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      403,
+      { message: "Forbidden" },
+      { headers: { "content-type": "application/json" } },
+    );
+});
@@ -0,0 +1,39 @@
+import { test } from "./main.js";
+
+// Verify transient network errors are retried when getting a repository token.
+await test((mockPool) => {
+  process.env.INPUT_OWNER = "actions";
+  process.env.INPUT_REPOSITORIES = "network-repo";
+  const owner = process.env.INPUT_OWNER;
+  const repo = process.env.INPUT_REPOSITORIES;
+  const mockInstallationId = "123456";
+  const mockAppSlug = "github-actions";
+
+  mockPool
+    .intercept({
+      path: `/repos/${owner}/${repo}/installation`,
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .replyWithError(new TypeError("fetch failed"));
+
+  mockPool
+    .intercept({
+      path: `/repos/${owner}/${repo}/installation`,
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github.v3+json",
+        "user-agent": "actions/create-github-app-token",
+        // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
+      },
+    })
+    .reply(
+      200,
+      { id: mockInstallationId, app_slug: mockAppSlug },
+      { headers: { "content-type": "application/json" } },
+    );
+});
Author	SHA1	Message	Date
create-app-token-action-releaser[bot]	f19919961c	chore(main): release 3.2.0	2026-05-08 18:56:39 +00:00
Stefan	952a2a7073	feat: add support for enterprise-level GitHub Apps (#263 ) This pull request adds support for generating GitHub App installation tokens for enterprise-level installations. ### What changed - Added a new `enterprise` input to `action.yml`. - Wired `enterprise` through `main.js` and `lib/main.js`. - Added validation so `enterprise` cannot be combined with `owner` or `repositories`. - Implemented enterprise installation lookup using the direct GitHub API route `GET /enterprises/{enterprise}/installation`, then used the returned installation ID to mint an installation token through `@octokit/auth-app`. - Updated `README.md` with enterprise installation usage and input documentation. - Updated `dist/main.cjs` for the bundled action. - Shared token creation retry behavior across repository, owner, and enterprise paths so server errors and transient network errors are retried, while client errors fail immediately. ### Tests Added focused test coverage for: - enterprise token creation - enterprise token creation with explicit permissions - enterprise installation not found - mutual exclusivity with `owner` - mutual exclusivity with `repositories` - owner installation client errors are not retried - transient network errors are retried during token creation ### Notes - This keeps the existing repository-scoped token behavior unchanged. - Owner, repository, and enterprise token creation now share the same retry policy: server errors and recognized transient network errors are retried, while client errors fail immediately. This intentionally fixes the previous owner-path behavior that retried client errors. Refs: - https://github.blog/changelog/2025-07-01-enterprise-level-access-for-github-apps-and-installation-automation-apis/ - https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-an-enterprise-installation-for-the-authenticated-app --------- Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-05-08 11:56:11 -07:00
dependabot[bot]	43e5c345bf	fix(deps): bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364 ) Bumps the production-dependencies group with 1 update: [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core). Updates `@actions/core` from 3.0.0 to 3.0.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md"><code>@actions/core</code>'s changelog</a>.</em></p> <blockquote> <h2>3.0.1</h2> <ul> <li>Bump <code>undici</code> from <code>6.23.0</code> to <code>6.24.1</code> <a href="https://redirect.github.com/actions/toolkit/pull/2348">#2348</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/toolkit/commits/HEAD/packages/core">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@actions/core&package-manager=npm_and_yarn&previous-version=3.0.0&new-version=3.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-07 19:09:31 -07:00
Parker Brown	6dbbbb1419	ci: use existing release tag format (#369 ) ## Summary This updates the release-please manifest configuration to use the repository's existing `vX.Y.Z` tag format. Without this setting, manifest mode looks for component-prefixed tags like `create-github-app-token-v3.1.1`, which do not exist in this repository and can cause release-please to include already-released commits in a new release PR. ## Changes - Sets `include-component-in-tag` to `false` for stable releases. - Sets `include-component-in-tag` to `false` for beta prereleases. This should make release-please use tags like `v3.1.1` as the previous release boundary. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-05-07 18:58:55 -07:00
Parker Brown	6be28c6ca7	ci: migrate releases to release-please (#367 ) ## Summary This updates release automation so the repository can enforce signed commits. Release version and changelog updates now happen through release-please PRs instead of direct workflow commits, which allows them to use the repository's normal signed-commit path. ## Changes - Replaces semantic-release configuration with release-please manifest configuration for stable releases and beta prereleases. - Builds committed `dist/**` assets from the trusted release workflow after release-please creates or updates a release PR, then commits those assets back to the release PR branch. - Keeps floating major version tags, such as `v3`, updated with the GitHub API after a release is created. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-05-07 18:13:10 -07:00
Josh Johanning	7989d206df	docs: use `APP_` prefix instead of reserved `GITHUB_` prefix (#363 ) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-04-21 09:56:11 -07:00
semantic-release-bot	1b10c78c78	build(release): 3.1.1 [skip ci] ## [3.1.1](https://github.com/actions/create-github-app-token/compare/v3.1.0...v3.1.1) (2026-04-11) ### Bug Fixes * improve error message when app identifier is empty ([#362](https://github.com/actions/create-github-app-token/issues/362)) ([`07e2b76`](https://github.com/actions/create-github-app-token/commit/07e2b760664f080c40eec4eacf7477256582db36)), closes [#249](https://github.com/actions/create-github-app-token/issues/249)	2026-04-11 06:43:26 +00:00
Parker Brown	07e2b76066	fix: improve error message when app identifier is empty (#362 ) When `client-id` (or the deprecated `app-id`) resolves to an empty string, for example because a secret or variable is not available in the workflow context, the error message from `@octokit/auth-app` is not very helpful: ``` [@octokit/auth-app] appId option is required ``` A validation check was added recently to catch this earlier, but its message could be more informative: ``` Either 'client-id' or 'app-id' input must be set ``` This updates the message to clarify that the value resolved to empty and nudges users toward checking their secret or variable availability: ``` The 'client-id' input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context. ``` Closes #249 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-10 23:42:53 -07:00
Parker Brown	ea0121618b	ci: remove publish-immutable-action workflow (#361 ) The `publish-immutable-action` workflow uses `actions/publish-immutable-action@v0.0.4`. The Immutable Actions Publishing feature (OCI-based) has been paused with no GA timeline. This removes the workflow; it can be re-added when the feature becomes generally available. To fully address #352, the repository-level immutable releases setting has also be enabled. This [feature](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/) locks release tags and assets after publication, directly preventing the class of attack described in [GHSA-mrrh-fwg8-r2c3](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3). The existing release workflow is compatible with immutable releases. Build artifacts are committed via `@semantic-release/git` before the tag is created, and major version tags (`v3`, etc.) are plain git tags (not releases) so they remain updatable.	2026-04-10 23:01:59 -07:00