How do I know what my Github App will need to do?

[Wicaeed]

Body

I've been assisting our QE team with setting up some Github Actions that can trigger workflows in a centralized repo containing Playwright automation tests from another repository. We were able to get things working after setting up a fine-grained PAT with the appropriate Repository permissions that is owned by the Developer. This works for testing, but it's not really a scalable solution since we have several hundred repositories that would potentially be needing similar fine-grained PAT's created & approved.

My thoughts right now is instead of having many PAT's out there, we could instead have a Github App, and to store the App token as an Org-wide secret available for any repos to use as a way to trigger jobs in this centralized testing repo.

I'm not that experienced with Github Apps; What would my Github App code actually need to do in this instance?

Say the Github Action workflow file in my calling repo looks like this:

on:
  deployment_status:
  workflow_dispatch:
jobs:
  smoke-tests:
    if: github.event.deployment_status.state == 'success'
    name: Smoke Tests against
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Trigger the automated smoke tests from playwright repo and wait for result
        uses: convictional/trigger-workflow-and-wait@v1.6.1
        with:
          owner: <NOPE>
          repo: automation-tests
          # This token expires on 06/03/2024
          github_token: ${{ secrets.PLAYWRIGHT_REPO_ACCESS_WITH_PAGES }}
          workflow_file_name: playwright-test.yml
          ref: poc-playwright-tests
          client_payload: '{"url": "${{github.event.deployment_status.target_url}}"}'

Would my Github App basically need to be doing exactly what is in the workflow file, but as API calls against Github API's?
Could the Github App itself handle rotating the token every 7 days, if we wanted it to?

Guidelines

• I have read and understood this category's guidelines before making this post.