feat: support tokens scoped to multiple repositories within organization

README.md

@@ -10,7 +10,7 @@ In order to use this action, you need to:
 2. [Store the App's ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`)
 3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`)
 
-### Minimal usage
+### Create token for current repository
 
 ```yaml
 on: [issues]
@@ -57,6 +57,73 @@ jobs:
           github_token: ${{ steps.app-token.outputs.token }}
 ```
 
+### Create token for all repositories in current owner's installation
+
+```yaml
+on: [workflow_dispatch]
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app_id: ${{ vars.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+      - uses: peter-evans/create-or-update-comment@v3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ github.event.issue.number }}
+          body: "Hello, World!"
+```
+
+### Create a token for selected repositories in current owner's installation
+
+```yaml
+on: [issues]
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app_id: ${{ vars.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "repo1,repo2"
+      - uses: peter-evans/create-or-update-comment@v3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ github.event.issue.number }}
+          body: "Hello, World!"
+```
+
+### Create token for all repositories in another owner's installation
+
+```yaml
+on: [issues]
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app_id: ${{ vars.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+          owner: another-owner
+      - uses: peter-evans/create-or-update-comment@v3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ github.event.issue.number }}
+          body: "Hello, World!"
+```
+
 ## Inputs
 
 ### `app_id`
@@ -67,6 +134,14 @@ jobs:
 
 **Required:** GitHub App private key.
 
+### `owner`
+
+**Optional:** GitHub App installation owner. If empty, defaults to the current repository owner.
+
+### `repositories`
+
+**Optional:** Comma-separated list of repositories to grant access to. If 'owner' is set and 'repositories' is empty then the access will be scoped to all repositories in the current repository owner's installation. If 'owner' and 'repositories' are empty then the access will be scoped to the current repository.
+
 ## Outputs
 
 ### `token`
@@ -77,7 +152,7 @@ GitHub App installation access token.
 
 The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app). By default,
 
-1. The token is scoped to the current repository.
+1. The token is scoped to the current repository or the repositories given.
 2. The token inherits all the installation's permissions.
 3. The token is set as output `token` which can be used in subsequent steps.
 4. The token is revoked in the `post` step of the action, which means it cannot be passed to another job.

action.yml

@@ -11,6 +11,12 @@ inputs:
   private_key:
     description: "GitHub App private key"
     required: true
+  owner:
+    description: "GitHub App owner (defaults to current repository owner)"
+    required: false
+  repositories:
+    description: "Repositories to install the GitHub App on (defaults to current repository)"
+    required: false
 outputs:
   token:
     description: "GitHub installation access token"

dist/main.cjs

@@ -14795,7 +14795,7 @@ var require_dist_node12 = __commonJS({
         data: {
           token,
           expires_at: expiresAt,
-          repositories,
+          repositories: repositories2,
           permissions: permissionsOptional,
           repository_selection: repositorySelectionOptional,
           single_file: singleFileName
@@ -14814,8 +14814,8 @@ var require_dist_node12 = __commonJS({
       });
       const permissions = permissionsOptional || {};
       const repositorySelection = repositorySelectionOptional || "all";
-      const repositoryIds = repositories ? repositories.map((r) => r.id) : void 0;
-      const repositoryNames = repositories ? repositories.map((repo) => repo.name) : void 0;
+      const repositoryIds = repositories2 ? repositories2.map((r) => r.id) : void 0;
+      const repositoryNames = repositories2 ? repositories2.map((repo) => repo.name) : void 0;
       const createdAt = (/* @__PURE__ */ new Date()).toISOString();
       await set(state.cache, optionsWithInstallationTokenFromState, {
         token,
@@ -15043,8 +15043,18 @@ var import_core = __toESM(require_core(), 1);
 var import_auth_app = __toESM(require_dist_node12(), 1);
 
 // lib/main.js
-async function main(appId2, privateKey2, repository2, core2, createAppAuth2, request2) {
-  const [owner, repo] = repository2.split("/");
+async function main(appId2, privateKey2, owner2, repositories2, core2, createAppAuth2, request2) {
+  let org = "";
+  if (owner2.length == 0) {
+    org = process.env.GITHUB_REPOSITORY_OWNER || "";
+  }
+  if (owner2.length == 0 && repositories2.length == 0) {
+    repositories2 = process.env.GITHUB_REPOSITORY?.split("/")[1] || "";
+  }
+  let repos = [];
+  if (repositories2.trim() != "") {
+    repos = repositories2.split(",").map((repo) => repo.trim());
+  }
   const auth = createAppAuth2({
     appId: appId2,
     privateKey: privateKey2,
@@ -15054,20 +15064,27 @@ async function main(appId2, privateKey2, repository2, core2, createAppAuth2, req
     type: "app"
   });
   const { data: installation } = await request2(
-    "GET /repos/{owner}/{repo}/installation",
+    "GET /orgs/{org}/installation",
     {
-      owner,
-      repo,
+      org,
       headers: {
         authorization: `bearer ${appAuthentication.token}`
       }
     }
   );
-  const authentication = await auth({
-    type: "installation",
-    installationId: installation.id,
-    repositoryNames: [repo]
-  });
+  let authentication;
+  if (repositories2.length == 0) {
+    authentication = await auth({
+      type: "installation",
+      installationId: installation.id
+    });
+  } else {
+    authentication = await auth({
+      type: "installation",
+      installationId: installation.id,
+      repositoryNames: repos
+    });
+  }
   core2.setSecret(authentication.token);
   core2.setOutput("token", authentication.token);
   core2.saveState("token", authentication.token);
@@ -15086,13 +15103,18 @@ var request_default = import_request.request.defaults({
 if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
 }
+if (!process.env.GITHUB_REPOSITORY_OWNER) {
+  throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
+}
 var appId = import_core.default.getInput("app_id");
 var privateKey = import_core.default.getInput("private_key");
-var repository = process.env.GITHUB_REPOSITORY;
+var owner = import_core.default.getInput("owner");
+var repositories = import_core.default.getInput("repositories");
 main(
   appId,
   privateKey,
-  repository,
+  owner,
+  repositories,
   import_core.default,
   import_auth_app.createAppAuth,
   request_default.defaults({

dist/post.cjs

@@ -2956,8 +2956,10 @@ var import_core = __toESM(require_core(), 1);
 // lib/post.js
 async function post(core2, request2) {
   const token = core2.getState("token");
-  if (!token)
+  if (!token) {
+    core2.info("Token is not set");
     return;
+  }
   await request2("DELETE /installation/token", {
     headers: {
       authorization: `token ${token}`

lib/main.js

@@ -3,21 +3,35 @@
 /**
  * @param {string} appId
  * @param {string} privateKey
- * @param {string} repository
+ * @param {string} owner
+ * @param {string} repositories
  * @param {import("@actions/core")} core
  * @param {import("@octokit/auth-app").createAppAuth} createAppAuth
  * @param {import("@octokit/request").request} request
  */
 export async function main(
   appId,
   privateKey,
-  repository,
+  owner,
+  repositories,
   core,
   createAppAuth,
   request
 ) {
-  // Get owner and repo name from GITHUB_REPOSITORY
-  const [owner, repo] = repository.split("/");
+
+  let org = "";
+  if (owner.length == 0) {
+    org = process.env.GITHUB_REPOSITORY_OWNER || "";
+  }
+
+  if (owner.length == 0 && repositories.length == 0) {
+    repositories = process.env.GITHUB_REPOSITORY?.split("/")[1] || "";
+  }
+
+  let repos = [];
+  if (repositories.trim() != "") {
+    repos = repositories.split(",").map((repo) => repo.trim());
+  }
 
   const auth = createAppAuth({
     appId,
@@ -32,23 +46,31 @@ export async function main(
   // Get the installation ID
   // https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app
   const { data: installation } = await request(
-    "GET /repos/{owner}/{repo}/installation",
+    "GET /orgs/{org}/installation",
     {
-      owner,
-      repo,
+      org,
       headers: {
         authorization: `bearer ${appAuthentication.token}`,
       },
     }
   );
 
   // Create a new installation token
-  const authentication = await auth({
-    type: "installation",
-    installationId: installation.id,
-    repositoryNames: [repo],
-  });
+  let authentication;
 
+  if (repositories.length == 0) {
+    authentication = await auth({
+      type: "installation",
+      installationId: installation.id,
+    });
+  } else {
+    authentication = await auth({
+      type: "installation",
+      installationId: installation.id,
+      repositoryNames: repos,
+    });
+  }
+
   // Register the token with the runner as a secret to ensure it is masked in logs
   core.setSecret(authentication.token);
 

main.js

@@ -10,15 +10,20 @@ if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
 }
 
+if (!process.env.GITHUB_REPOSITORY_OWNER) {
+  throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
+}
+
 const appId = core.getInput("app_id");
 const privateKey = core.getInput("private_key");
-
-const repository = process.env.GITHUB_REPOSITORY;
+const owner = core.getInput("owner");
+const repositories = core.getInput("repositories");
 
 main(
   appId,
   privateKey,
-  repository,
+  owner,
+  repositories,
   core,
   createAppAuth,
   request.defaults({