github-app-token.yml

name: "GitHub App Token Example"
on:
  push:
  workflow_dispatch:

jobs:
  github-app-token-example:
    runs-on: ubuntu-latest
    steps:

    # Get the GitHub app installation token.
    - run: npm install @octokit/app@v13.1.8
    - name: Generate Token
      uses: actions/github-script@v6
      id: token
      env:
        GH_APP_ID: ${{ secrets.GH_APP_ID }}
        GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
      with:
        script: |
          const { App } = require("@octokit/app");
          const app = new App({
            appId: process.env.GH_APP_ID,
            privateKey: process.env.GH_APP_PRIVATE_KEY,
          });
          const id = (await app.octokit.request("GET /repos/${{ github.repository }}/installation")).data.id;
          // const id = (await app.octokit.request("GET /orgs/${{ github.repository_owner }}/installation")).data.id;
          // const id = (await app.octokit.request("GET /users/${{ github.repository_owner }}/installation")).data.id;
          const token = (await app.octokit.request(`POST /app/installations/${id}/access_tokens`)).data.token;
          core.setSecret(token);
          return token;
        result-encoding: string

    # Example usage.
    - name: "Example: Use the GitHub app installation token"
      uses: actions/github-script@v6
      with:
        github-token: ${{ steps.token.outputs.result }}
        script: |
          const { data } = await github.rest.repos.createCommitStatus({
            owner: context.payload.repository.owner.login,
            repo: context.payload.repository.name,
            sha: context.sha,
            state: 'success',
            context: 'App',
          });
          console.log(data);

    # Revoke the GitHub app installation token (optional).
    - name: Revoke Token
      uses: actions/github-script@v6
      if: always() && steps.token.outcome == 'success'
      with:
        github-token: ${{ steps.token.outputs.result }}
        script: |
          await github.rest.apps.revokeInstallationAccessToken();