tibdex/github-app-token
GitHub: tibdex/github-app-token
在 GitHub Actions 工作流中模拟 GitHub App 身份生成访问令牌，替代受限的默认 token 和个人访问令牌。
Stars: 562 | Forks: 153
# GitHub App Token
当 `secrets.GITHUB_TOKEN` 的限制过于严格且不适合使用个人访问令牌时，可以使用这个 [JavaScript GitHub Action](https://help.github.com/en/actions/building-actions/about-actions#javascript-actions) 来模拟（ impersonate ） GitHub App。
例如，摘自 [GitHub Actions 文档](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)：
一种变通方法是使用来自[个人用户/机器人账户](https://help.github.com/en/github/getting-started-with-github/types-of-github-accounts#personal-user-accounts)的[个人访问令牌](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)。
然而，对于组织而言，GitHub App 是[更合适的自动化解决方案](https://developer.github.com/apps/differences-between-apps/#machine-vs-bot-accounts)。
# 示例工作流
```
jobs:
job:
runs-on: ubuntu-latest
steps:
- id: create_token
uses: tibdex/github-app-token@v2
with:
app_id: ${{ secrets.APP_ID }}
# Optional.
# github_api_url: https://api.example.com
# Optional.
# installation_retrieval_mode: id
# Optional.
# installation_retrieval_payload: 1337
# Optional.
# Using a YAML multiline string to avoid escaping the JSON quotes.
# permissions: >-
# {"pull_requests": "read"}
private_key: ${{ secrets.PRIVATE_KEY }}
# Optional.
# repositories: >-
# ["actions/toolkit", "github/docs"]
# Optional.
# revoke: false
- run: "echo 'The created token is masked: ${{ steps.create_token.outputs.token }}'"
```
[GitHub 官方文档中也可以（或曾经可以）找到此 action 的另一个用例](https://web.archive.org/web/20230115194214/https://docs.github.com/en/issues/planning-and-tracking-with-projects/automating-your-project/automating-projects-using-actions#example-workflow-authenticating-with-a-github-app)。
标签：GitHub Actions, MITM代理, SOC Prime, 令牌管理, 开发工具, 数据可视化, 网络调试, 自动化, 自动化攻击, 自动笔记