{"id":17093007,"url":"https://github.com/peter-murray/workflow-application-token-action","last_synced_at":"2025-05-16T09:04:50.893Z","repository":{"id":37482173,"uuid":"283244866","full_name":"peter-murray/workflow-application-token-action","owner":"peter-murray","description":"GitHub Action that will get a scoped short lived token for Actions workflows using a GitHub Application.","archived":false,"fork":false,"pushed_at":"2025-03-20T21:07:57.000Z","size":1807,"stargazers_count":192,"open_issues_count":8,"forks_count":50,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-05-05T20:04:08.967Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/peter-murray.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-07-28T14:57:27.000Z","updated_at":"2025-04-29T15:02:19.000Z","dependencies_parsed_at":"2024-01-29T16:53:03.600Z","dependency_job_id":"d6ed4fc2-4c35-47fc-be3d-1c6db2a66a47","html_url":"https://github.com/peter-murray/workflow-application-token-action","commit_stats":{"total_commits":54,"total_committers":4,"mean_commits":13.5,"dds":0.07407407407407407,"last_synced_commit":"dc0413987a085fa17d19df9e47d4677cf81ffef3"},"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peter-murray%2Fworkflow-application-token-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peter-murray%2Fworkflow-application-token-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peter-murray%2Fworkflow-application-token-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/peter-murray%2Fworkflow-application-token-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/peter-murray","download_url":"https://codeload.github.com/peter-murray/workflow-application-token-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254501557,"owners_count":22081528,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-14T14:04:10.254Z","updated_at":"2025-05-16T09:04:45.883Z","avatar_url":"https://github.com/peter-murray.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# workflow-application-token-action\n\nThis is a GitHub Action that can be used to get scoped limited access, expiring credentials for use inside GitHub Actions\nWorkflows.\n\nWhy would you want to do this? Well the `GITHUB_TOKEN` whilst having an expiry, has some protections around creating\nevents that prevent downstream GitHub Actions workflow from triggering. This prevents recursive loops from workflows, but\nthere are a number of valid types of workflows that may require or desire triggering downstream GitHub Actions Workflows.\n\nThe existing way to work around this today is to use a Personal Access Token, but these tokens are tied to a user and\ngenerally are over priviledged for the tasks at hand, increasing the risk if they get exposed and are not time limited\nlike the `GITHUB_TOKEN`.\n\nThis is where a GitHub Application access token can really help out. The benefits of GitHub Applications is that you can\nrestrict/scope the access of the token considerably more than what can be achieved using a Personal Access Token. The\naccess token from the GitHub Application is also time limited, expiring after an hour from being issued, providing some\nmore protection against any leaking of credentials from a Workflow.\n\n\n## Usage\nTo use this action you first need a GitHub Application created so that you can request temporary credentials on behalf\nof the application inside your workflows.\n\n__Requirements:__\n* A new or existing GitHub Application with the access scopes required\n* A private key for the GitHub Application\n* The GitHub Application installed on the repository that the GitHub Actions Workflow will execute from\n\n\n### Creating a GitHub Application\nYou will need to have a GitHub Application that is scoped with the necessary permissions for the token that you want to\nretrieve at runtime.\n\nTo create a GitHub Application you can follow the steps available at https://docs.github.com/en/developers/apps/creating-a-github-app\n\nThe important configuration details for the application are:\n* `GitHub App name` a human readable application name that is unique within GitHub.com\n* `Description` some details about your application and what you intend to use it for\n* `Homepage URL` needs to be set to something as long as it is a URL\n* `Expire user authorization tokens` should be checked so as to expire any tokens that are issued\n* `Webhook` `Active` checkbox should be unchecked\n* `Repository permissions`, `Organization permissions` and/or `User permissions` should be set to allow the access required for the token that will be issued\n* `Where can this GitHub App be installed?` should be scoped to your desired audience (the current account, or any account)\n\nOnce the application has been created you will be taken to the `General` settings page for the new application.\nThe GitHub Application will be issued an `App ID` which you can see in the `About` section, take note of this for later\nuse in the Actions workflow.\n\nOn the `General` settings page for the application, at the bottom there is a `Private keys` section that you can use to\ngenerate a private key that can be utilized to authenticate as the application.\nGenerate a new private key and store the information for later use.\n\n_Note: the private keys can and should be rotated periodically to limit the risks of them being exposed in use._\n\n\n### Install the GitHub Application\nOnce you have the GitHub Application defined, you will need to install the application on the target organization or repository/\nrepositories that you want it to have access to. These will be any repositories that you want to gather information\nfrom or want the application to modify as per the scopes that were defined when the application was installed.\n\n_Note: The GitHub Application will need to be installed on the organization and or repository that you are executing\nthe GitHub Actions workflow from, as the implementation requires this to be able to generate the access tokens_.\n\n\n### Using the GitHub Action in a Workflow\n\nTo use the action in a workflow, it is recommended that you store the GitHub Application Private key in GitHub Secrets.\nThis can be done at a repository or organization level (provided that the actions workflow has access to the secret).\n\nWhen storing the Private key, you can store the raw PEM encoded certificate contents that the GitHub Application\ngenerates for you or Base64 encode it in the secret.\n\n#### Parameters\n\n* `application_id`: The GitHub Application ID that you wil be getting the access token for\n* `application_private_key`: A private key generated for the GitHub Application so that you can authenticate (PEM format or base64 encoded)\n* `permissions`: The optional limited permissions to request, specifying this allows you to request a subset of the permissions for the underlying GitHub Application. Defaults to all permissions available to the GitHub Application when not specified. Must be provided in a comma separated list of token permissions e.g. `issues:read, secrets:write, packages:read`. To see the list of valid permission names, check [this doc](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app), scroll down to the `Permissions` object, and expand the drop-down for `Properties of permissions`.\n* `organization`: An optional organization name if the GitHub Application is installed at the Organization level (instead of the repository).\n* `github_api_base_url`: An optional URL to the GitHub API, this will be read and loaded from the runner environment by default, but you might be bridging access to a secondary GHES instance or from GHES to GHEC, you can utilize this to make sure the Octokit library is talking to the right GitHub instance.\n* `https_proxy`: An optional proxy to use for connecting with the GitHub instance. If the runner has `HTTP_PROXY` or `HTTPS_PROXY` specified as environment variables it will attempt to use those if this parameter is not specified.\n* `revoke_token`: An optional boolean `true` or `false` value to revoke the access token as part of the post job steps in the actions workflow. To preserve backwards compatibility on this action, it defaults to `false`.\n\n#### Examples\nGet a token with all the permissions of the GitHub Application:\n```yaml\n\njobs:\n  get-temp-token:\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Get Token\n        id: get_workflow_token\n        uses: peter-murray/workflow-application-token-action@v4\n        with:\n          application_id: ${{ secrets.APPLICATION_ID }}\n          application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}\n\n      - name: Use Application Token to create a release\n        uses: actions/create-release@v1\n        env:\n          GITHUB_TOKEN: ${{ steps.get_workflow_token.outputs.token }}\n        with:\n          ....\n```\n\nGet a token with a limited subset of the permissions of the Github Application, in this case just the `actions:write` permission:\n```yaml\n\njobs:\n  get-temp-token:\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Get Token\n        id: get_workflow_token\n        uses: peter-murray/workflow-application-token-action@v4\n        with:\n          application_id: ${{ secrets.APPLICATION_ID }}\n          application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}\n          permissions: \"actions:write\"\n\n      - name: Use Application Token to create a release\n        uses: actions/create-release@v1\n        env:\n          GITHUB_TOKEN: ${{ steps.get_workflow_token.outputs.token }}\n        with:\n          ....\n```\n\nGet a token with all the permissions of the Github Application that is installed on an organization:\n```yaml\n\njobs:\n  get-temp-token:\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Get Token\n        id: get_workflow_token\n        uses: peter-murray/workflow-application-token-action@v4\n        with:\n          application_id: ${{ secrets.APPLICATION_ID }}\n          application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}\n          organization: octodemo\n\n      - name: Use Application Token to create a release\n        uses: actions/create-release@v1\n        env:\n          GITHUB_TOKEN: ${{ steps.get_workflow_token.outputs.token }}\n        with:\n          ....\n```\n\n### Proxy\n\nYou can specify a proxy server directory using the `https_proxy` parameter in your `with` settings, or by falling back to\nusing any environment variables used to provide a proxy reference; `HTTP_PROXY` or `HTTPS_PROXY` (or lowercase variants e.g. `http_proxy`).\nIf defined, the request will use the proxy to route the connection to the GitHub instance.\n\n```yaml\n\njobs:\n  get-temp-token:\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Get Token\n        id: get_workflow_token\n        uses: peter-murray/workflow-application-token-action@v4\n        with:\n          application_id: ${{ secrets.APPLICATION_ID }}\n          application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}\n          organization: octodemo\n          https_proxy: http://my-squid-proxy:3128\n          ....\n```\n\nIn version `2.1.0` of this action support has been added for `no_proxy` environment variables that might be present in the workflows or actions runner.\n\nIf the `https_proxy` input variable is specified for the action, then any `no_proxy` setting will be ignored as the proxy in this case has been explicitly set and\nthis action views that as being entirely intentional.\n\nIf on the other hand the proxy server is being detected using environment variables, `http_proxy`, `HTTP_PROXY`, `https_proxy`, `HTTPS_PROXY` and `no_proxy` is present\nthen it will be parsed for hostname matches as to whether or not to use the proxy when access the GitHub API.\n\nThe format that is supported for `no_proxy` environment variable is a comma separated list of host names, e.g. `api.github.com,www.google.com` of when to not use the proxy server.\n\n\n### Access Token revocation\n\nTo provide additional options for security around the access token and waiting on it to expire, you can leverage the `revoke_token` input set to `true` so that at the end of the\njob run, a post actions step will revoke the access token, invalidating it so that is is immediately invalid and cannot be used.\n\n\n\n### References\nhttps://docs.github.com/en/developers/apps/authenticating-with-github-apps#authenticating-as-an-installation\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpeter-murray%2Fworkflow-application-token-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpeter-murray%2Fworkflow-application-token-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpeter-murray%2Fworkflow-application-token-action/lists"}