GitHub Apps for CI

When PATs aren't enough

Personal Access Tokens (PATs) are tied to a user account. They expire when the user leaves, they have whatever permissions the user has, and they don't scale to automation that needs to act 'as itself'.

GitHub Apps are first-class identities. They can be installed on an org or specific repos, granted fine-grained permissions, and authenticate via JWT + short-lived installation tokens. Most automation should be a GitHub App.

Use cases

Cross-repo workflows — workflow in repo A needs write to repo B. PATs don't scope across repos cleanly; GitHub Apps do.
Bot accounts — release-please, semantic-release, dependabot — all are or behave like GitHub Apps.
Custom integrations — Slack bots, custom dashboards, internal tooling.
Higher rate limits — App tokens have higher API rate limits than PATs.

The auth flow

Generate JWT signed by the App's private key.
Exchange JWT for an installation token (~1 hour).
Use the installation token in API calls / git operations.

Actions: actions/create-github-app-token handles the dance for you. Output is the token; pass it through env to subsequent steps.

Code

Cross-repo write via App token·yaml

  cross-repo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v1
        id: app
        with:
          app-id: ${{ vars.MY_BOT_APP_ID }}
          private-key: ${{ secrets.MY_BOT_APP_PRIVATE_KEY }}
          owner: my-org
          repositories: target-repo
      - run: |
          curl -H "Authorization: Bearer ${{ steps.app.outputs.token }}" \
            -X POST https://api.github.com/repos/my-org/target-repo/dispatches \
            -d '{"event_type":"deploy-prod"}'

When PATs aren't enough

Use cases

The auth flow

Code

External links

Exercise

Progress

Comments 0