action-github-app-token
https://github.com/getsentry/action-github-app-token- Category
- Developer Tools
- Rank
- No. 1456Tools index
Previous survey · No. 1438 ·
- Pricing
- Open Source
- Type
- TOOL
- Builder
- getsentry
- GitHub
- 223 stars
- Latest release
- v4.0.0
- Date
About
GitHub Action that exchanges your GitHub App credentials for an installation access token — avoid PATs in workflows.
What it does
This workflow component signs in as a GitHub App, discovers its installations, and returns credentials for one installation. You provide an app ID and private key. An optional account scope selects a matching installation; otherwise it chooses the first result. The output can authenticate later workflow steps, such as checking out a private repository.
Why it's ranked here
It solves a narrow automation problem with little workflow ceremony and sensible secret masking. The implementation supports both public GitHub and custom API endpoints, while tests cover selection, authentication failure, masking order, and endpoint choice. Its main weakness is ambiguous default selection when an app has several installations.
What's good
The private key is masked before the API client is created, and the returned credential is masked before publication as an output. Account scoping lets workflows select an organization by login. Pull requests run unit tests, linting, formatting checks, a distribution build, and an integration checkout against a private repository.
Tradeoffs
Without an account scope, it blindly selects the first installation returned by GitHub. A missing scope match fails clearly, but an empty installation list would fail while reading the first result rather than through an explicit check. The action exposes one credential output and no controls here for narrowing token permissions or repository access.
How to use it well
Use it in GitHub Actions when an established GitHub App needs to authenticate later steps across repositories. Set an explicit account scope whenever the app has multiple installations, keep both required inputs in repository secrets, and pass the output only to steps that need it. It does not create or configure the GitHub App, manage secret storage, or replace broader credential governance.
Technical notes+
src/main.ts builds an Octokit client with createAppAuth, using GITHUB_API_URL or https://api.github.com, lists installations, selects the first or matches scope against an account login, requests installation authentication, masks secrets with core.setSecret, and publishes token. src/main.test.ts mocks Actions and Octokit modules and covers masking order, scoped selection, failures, output, and base URL behavior. action.yml declares a Node 24 action with required app_id and private_key, optional scope, and a token output. package.json provides TypeScript, Jest, ESLint, Prettier, and ncc scripts. .github/workflows/test.yml runs checks plus a private-repository checkout integration test on pull requests.
Observed
- License
- MIT
- Primary language
- TypeScript
- Interface
- GitHub Action with app ID, private key, optional account scope, and token output
- Runtime
- Node 24
- Build surface
- Yarn scripts compile TypeScript and package the action with ncc
- Testing
- Jest unit tests plus a pull-request integration checkout of a private repository
- Platform support
- Uses the configured GitHub API URL when present, otherwise the public GitHub API
Read from README.md, package.json, src/main.ts, src/main.test.ts, eslint.config.mjs, action.yml, tsconfig.json, .github/workflows/test.yml.
What it can do
Exchange GitHub App credentials for installation access token
GitHub App ID, private key, and installation ID → Installation access token
Authenticate GitHub workflows without personal access tokens
GitHub App credentials → Authenticated workflow session
Generate temporary API access tokens for GitHub repositories
GitHub App authentication details → Time-limited repository access token
Enable secure repository access in CI/CD pipelines
GitHub App configuration and workflow context → Secure API access credentials
Replace personal access tokens with app-based authentication
GitHub App setup and target repository → App-scoped access token
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.