Clay Miller
9b283559f1
Part of https://github.com/actions/create-github-app-token/issues/43 This PR adds tests for [`main.js`](https://github.com/actions/create-github-app-token/blob/main/lib/main.js), similar to [the tests that already exist for `post.js`](https://github.com/actions/create-github-app-token/tree/main/tests). Specifically, it tests that: - `main` exits with an error when `GITHUB_REPOSITORY` is missing. - `main` exits with an error when `GITHUB_REPOSITORY_OWNER` is missing. - `main` successfully obtains a token when… - …the `owner` and `repositories` inputs are set (and the latter is a single repo). - …the `owner` and `repositories` inputs are set (and the latter is a list of repos). - …the `owner` input is set (to an org), but the `repositories` input isn’t set. - …the `owner` input is set (to a user), but the `repositories` input isn’t set. - …the `owner` input is not set, but the `repositories` input is set. - …neither the `owner` nor `repositories` input is set. ❧ Architecturally, in order to keep individual tests concise, this PR adds `tests/main.js`, which: - sets commonly-used inputs, environment variables, and mocks, then - calls a callback function that can edit the variables and add additional mocks, then - runs `main.js` itself. The `tests/main-token-get-*.test.js` test files run `tests/main.js` with various scenario-specific callback functions.
Create GitHub App Token
GitHub Action for creating a GitHub App installation access token.
Usage
In order to use this action, you need to:
- Register new GitHub App
- Store the App's ID in your repository environment variables (example:
APP_ID) - Store the App's private key in your repository secrets (example:
PRIVATE_KEY)
Create a token for the current repository
on: [issues]
jobs:
hello-world:
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v1
id: app-token
with:
app_id: ${{ vars.APP_ID }}
private_key: ${{ secrets.PRIVATE_KEY }}
- uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.app-token.outputs.token }}
issue-number: ${{ github.event.issue.number }}
body: "Hello, World!"
Use app token with actions/checkout
on: [pull_request]
jobs:
auto-format:
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v1
id: app-token
with:
# required
app_id: ${{ vars.APP_ID }}
private_key: ${{ secrets.PRIVATE_KEY }}
- uses: actions/checkout@v3
with:
token: ${{ steps.app-token.outputs.token }}
ref: ${{ github.head_ref }}
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
persist-credentials: false
- uses: creyD/prettier_action@v4.3
with:
github_token: ${{ steps.app-token.outputs.token }}
Create a token for all repositories in the current owner's installation
on: [workflow_dispatch]
jobs:
hello-world:
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v1
id: app-token
with:
app_id: ${{ vars.APP_ID }}
private_key: ${{ secrets.PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
- uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.app-token.outputs.token }}
issue-number: ${{ github.event.issue.number }}
body: "Hello, World!"
Create a token for multiple repositories in the current owner's installation
on: [issues]
jobs:
hello-world:
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v1
id: app-token
with:
app_id: ${{ vars.APP_ID }}
private_key: ${{ secrets.PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
repositories: "repo1,repo2"
- uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.app-token.outputs.token }}
issue-number: ${{ github.event.issue.number }}
body: "Hello, World!"
Create a token for all repositories in another owner's installation
on: [issues]
jobs:
hello-world:
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v1
id: app-token
with:
app_id: ${{ vars.APP_ID }}
private_key: ${{ secrets.PRIVATE_KEY }}
owner: another-owner
- uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.app-token.outputs.token }}
issue-number: ${{ github.event.issue.number }}
body: "Hello, World!"
Inputs
app_id
Required: GitHub App ID.
private_key
Required: GitHub App private key.
owner
Optional: GitHub App installation owner. If empty, defaults to the current repository owner.
repositories
Optional: Comma-separated list of repositories to grant access to.
Note
If
owneris set andrepositoriesis empty, access will be scoped to all repositories in the provided repository owner's installation. Ifownerandrepositoriesare empty, access will be scoped to only the current repository.
skip_token_revoke
Optional: If truthy, the token will not be revoked when the current job is complete.
Outputs
token
GitHub App installation access token.
How it works
The action creates an installation access token using the POST /app/installations/{installation_id}/access_tokens endpoint. By default,
- The token is scoped to the current repository or
repositoriesif set. - The token inherits all the installation's permissions.
- The token is set as output
tokenwhich can be used in subsequent steps. - Unless the
skip_token_revokeinput is set to a truthy value, the token is revoked in thepoststep of the action, which means it cannot be passed to another job. - The token is masked, it cannot be logged accidentally.
Note
Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.