Authenticate as a GitHub App installation and generate a short-lived access token.

This action implements the GitHub App authentication flow — it mints a JWT from your App's private key, exchanges it for an installation access token via the GitHub API, and exposes that token as a step output for use in subsequent workflow steps.

1. A short-lived JWT (10-minute expiry) is signed using the App's RSA private key.
2. The JWT is used to call GET /app/installations and retrieve the first installation ID.
3. The installation ID is used to call POST /app/installations/{id}/access_tokens, returning a scoped access token (valid for ~1 hour).

The token is printed to stdout, captured, and written to $GITHUB_OUTPUT.

You need a GitHub App with:

• An RSA private key (download from the App settings page)
• The App installed on the organization or repository where the workflow runs

Store the private key and App ID as encrypted secrets in your repository or organization.

---
name: Example
on:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Authenticate as GitHub App Installation
        id: auth-github
        uses: eleanorhealth/github-app-installation-auth-action@main
        with:
          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
          app-id: ${{ secrets.GITHUB_APP_ID }}

      - name: Use the token
        run: |
          echo "Token acquired, length: ${#TOKEN}"
        env:
          TOKEN: ${{ steps.auth-github.outputs.github_app_token }}

A common pattern is to configure git to use the token for HTTPS cloning of private repositories:

      - name: Configure git with App token
        run: |
          git config --global url."https://x-access-token:${TOKEN}@github.com/your-org".insteadOf \
            "https://github.com/your-org"
        env:
          TOKEN: ${{ steps.auth-github.outputs.github_app_token }}

Security note: The token is valid for approximately 1 hour. It is automatically revoked when it expires. Never log or expose the token value in workflow output.

The action is a composite action that:

1. Installs Python 3.11 via actions/setup-python@v5
2. Installs pinned Python dependencies from requirements.txt
3. Runs src/github_app_token.py with --direct mode, passing the App ID and private key as arguments

The Python script supports four input modes (all mutually exclusive):

When using --env, --file, or --inline, the JSON must contain DEPLOYER_GITHUB_APP_ID and PRIVATE_KEY keys.

Dependencies are managed with pip-tools. All packages are pinned to exact versions with SHA-256 hashes in requirements.txt for reproducible, tamper-evident installs.

# Upgrade all dependencies to their latest compatible versions
pip-compile --generate-hashes --upgrade

# Add a new dependency without upgrading existing ones
# 1. Add it to requirements.in
# 2. Run:
pip-compile --generate-hashes --no-upgrade

# Sync your local environment exactly to requirements.txt
pip-sync requirements.txt