Skip to content

ci: actions/create-github-app-token -> v3 #8240

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
matthewelwell wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −2
Open

ci: actions/create-github-app-token -> v3 #8240

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/api-fix-docs-artefacts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ jobs:
steps:
- name: Generate GitHub App token with push access
id: app-token
uses: actions/create-github-app-token@v1
uses: actions/create-github-app-token@v3

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpts =="
sed -n '1,120p' .github/workflows/api-fix-docs-artefacts.yml 2>/dev/null || true
echo
sed -n '1,60p' .github/workflows/renovate.yml 2>/dev/null || true

echo
echo "== create-github-app-token references =="
rg -n "actions/create-github-app-token|create-github-app-token|client-id|permissions:|github-app-token" .github/workflows .github 2>/dev/null || true

Repository: Flagsmith/flagsmith

Length of output: 7615

🌐 Web query:

actions create-github-app-token v3 input client-id permissions

💡 Result:

In version 3 of the actions/create-github-app-token GitHub Action, the client-id input is the recommended way to identify your GitHub App, replacing the legacy app-id input [1][2][3]. The action also provides granular control over the permissions granted to the generated token through dynamically defined permission- inputs [4][5][6]. Key details regarding these inputs include: client-id This is a required input used to specify the GitHub App's Client ID [1][2]. While the legacy app-id input is still supported for backward compatibility, it is deprecated in favor of client-id [1][3][7]. If both are provided, client-id takes precedence [3]. Permission Inputs (permission-) The action supports granular control over the GitHub API scopes granted to the resulting installation access token [4][5]. - Usage: You can explicitly list required permissions by prefixing the permission name with permission- (e.g., permission-pull-requests for pull_requests) [1][4]. - Default Behavior: If no permission- inputs are provided, the generated token inherits all permissions currently granted to the GitHub App installation [1][4][5]. - Security Recommendation: It is considered a security best practice to explicitly list only the permissions necessary for your specific use case to follow the principle of least privilege [1][7]. - Validation: When setting these permissions, ensure they are granted to the specific app installation; requesting a permission that the installation does not possess will result in an error [1][5]. - Values: Generally, these inputs accept read or write, and in some cases, admin [5][6]. Example usage: - uses: actions/create-github-app-token@v3 with: client-id: ${{ vars.GITHUB_APP_CLIENT_ID }} private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} permission-contents: read permission-pull-requests: write

Citations:

🌐 Web query:

actions create-github-app-token bcd2ba49218906704ab6c1aa796996da409d3eb1

💡 Result:

The string bcd2ba49218906704ab6c1aa796996da409d3eb1 is the specific git commit hash corresponding to version 3.2.0 of the official actions/create-github-app-token GitHub Action [1][2]. This action is an official GitHub-owned tool used to generate installation access tokens for GitHub Apps within a GitHub Actions workflow [3][4]. It allows workflows to authenticate and perform API requests on behalf of a GitHub App by exchanging the app's credentials (typically a client ID and private key stored in repository secrets/variables) for a temporary, short-lived installation access token [3][5][6]. Key details about this version and the action: - Purpose: Enables secure, authenticated API interactions by GitHub Apps within CI/CD pipelines [4][5]. - Version 3.2.0: This release was published on May 12, 2026 [7]. The specific commit hash bcd2ba49218906704ab6c1aa796996da409d3eb1 is frequently used in workflow configurations to pin the dependency to this specific release for stability [1][2]. - Functionality: It supports various scoping options (e.g., enterprise, owner, or specific repositories), automatically masks generated tokens in logs, and includes a post-job execution phase to revoke the token by default for enhanced security [3][5][6].

Citations:

Pin actions/create-github-app-token to the full commit SHA.

api-fix-docs-artefacts.yml still uses the mutable @v3 tag, while renovate.yml already uses bc d2ba49218906704ab6c1aa796996da409d3eb1. Pin the reference to avoid unintended action code drift, unless FLAGSMITH_ENGINEERING_GH_APP_ID must stay as an App ID rather than a Client ID; if it does, client-id needs to be replaced before pinning.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 31-31: missing input "app-id" which is required by action "actions/create-github-app-token@v3". all required inputs are "app-id", "private-key"

(action)

🪛 zizmor (1.29.0)

[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 31-31: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions

(github-app)

Source: Linters/SAST tools

with:
app-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
Comment on lines +31 to +33

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files matching api-fix-docs-artefacts =="
fd -a 'api-fix-docs-artefacts\.ya?ml$' .github/workflows || true

echo "== target file excerpt =="
if [ -f .github/workflows/api-fix-docs-artefacts.yml ]; then
  cat -n .github/workflows/api-fix-docs-artefacts.yml | sed -n '1,110p'
fi

echo "== action ref occurrences =="
rg -n "create-github-app-token|actions/checkout|git push|permission-contents|install-id|client-id|private-key" .github/workflows/api-fix-docs-artefacts.yml .github/workflows 2>/dev/null || true

echo "== git status/stat =="
git diff --stat || true

Repository: Flagsmith/flagsmith

Length of output: 6599

🌐 Web query:

actions/create-github-app-token v3 permission-contents input inheritance default permissions

💡 Result:

The actions/create-github-app-token action uses an inheritance-based model for permissions [1][2]. By default, if no specific permission-* inputs are provided, the generated GitHub App installation token inherits all permissions currently granted to the GitHub App installation [1][3][4]. When you explicitly provide permission-* inputs (such as permission-contents), you are overriding this default behavior [3][5]. In this case, the token will only be granted the specific permissions you have explicitly defined in the workflow step, rather than the full set of permissions associated with the installation [3][5]. Key points regarding this behavior: - Inheritance: Without explicit permission inputs, the token receives the full scope of the installation's permissions [1][4]. - Explicit Configuration: If you define even one permission-* input, you effectively switch to a restricted mode where only the specified permissions are applied [3][5]. - Best Practice: It is recommended to explicitly list only the permissions required for your specific use case to follow the principle of least privilege [1][3][6]. - Validation: You must ensure that any permission requested via permission-* inputs has been granted to the GitHub App installation itself; otherwise, the action will fail [1][4][6]. Source documentation confirms that this mechanism remains consistent in version 3, which continues to support these granular permission inputs to provide fine-grained access control [1][7].

Citations:

Restrict the generated token to repository contents.

actions/create-github-app-token gives all installation permissions by default unless a permission-* input is provided. Since this token is only used for checkout and push, add only permission-contents: write.

Proposed fix 
         with:
           client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
           private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}
+          permission-contents: write
🧰 Tools
🪛 actionlint (1.7.12)

[error] 31-31: missing input "app-id" which is required by action "actions/create-github-app-token@v3". all required inputs are "app-id", "private-key"

(action)

[error] 33-33: input "client-id" is not defined in action "actions/create-github-app-token@v3". available inputs are "app-id", "github-api-url", "owner", "permission-actions", "permission-administration", "permission-checks", "permission-codespaces", "permission-contents", "permission-custom-properties-for-organizations", "permission-dependabot-secrets", "permission-deployments", "permission-email-addresses", "permission-enterprise-custom-properties-for-organizations", "permission-environments", "permission-followers", "permission-git-ssh-keys", "permission-gpg-keys", "permission-interaction-limits", "permission-issues", "permission-members", "permission-metadata", "permission-organization-administration", "permission-organization-announcement-banners", "permission-organization-copilot-seat-management", "permission-organization-custom-org-roles", "permission-organization-custom-properties", "permission-organization-custom-roles", "permission-organization-events", "permission-organization-hooks", "permission-organization-packages", "permission-organization-personal-access-token-requests", "permission-organization-personal-access-tokens", "permission-organization-plan", "permission-organization-projects", "permission-organization-secrets", "permission-organization-self-hosted-runners", "permission-organization-user-blocking", "permission-packages", "permission-pages", "permission-profile", "permission-pull-requests", "permission-repository-custom-properties", "permission-repository-hooks", "permission-repository-projects", "permission-secret-scanning-alerts", "permission-secrets", "permission-security-events", "permission-single-file", "permission-starring", "permission-statuses", "permission-team-discussions", "permission-vulnerability-alerts", "permission-workflows", "private-key", "repositories", "skip-token-revoke"

(action)

🪛 zizmor (1.29.0)

[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 31-31: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions

(github-app)

Source: Linters/SAST tools

private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}

- name: Cloning repo
Expand Down
Loading