Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

be able to fetch Installation Token using a BYO JWT

Aperta
#219 9 commenti 2 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
52/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
github-actions, javascript
Ambito
api, authentication, security

Direzione di ricerca

No file or test is named in the issue. Start by tracing the action's current inputs and GitHub App installation-token flow, then review how a caller-provided JWT could fit that flow without requiring the private key. Done means a workflow can supply its own JWT, receive the installation token, and retain the existing behavior for other users.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

stale

Story

Given that credentials can be leaked from GitHub actions accidentally or intentionally by a variety of means
As a security-conscious GHA workflow owner
When there is a Requirement to use a high-privileged GitHub App in a workflow
I need a way to put only short-lived, easy to rotate creds into the workflow context
so that if the cred is leaked, the risk of exploitation is time-bound and easier to contain/respond to

Scenario

  • Summary: A workflow owner already has a way to get the JWT, but wants to use this Action to get the installation token.
  • How is the JWT obtained? A GH App's Private Key has been stored in a Secrets Store, such that it can be used for signing claims but cannot be downloaded.
  • What would we want this Action/create-github-app-token to change? Allow the workflow consumer to provide their own JWT, and not have to rewrite the logic for getting an Installation Token.
  • What's the security benefit? The Private Key never leaves the Secret Store. It's never directly exposed in any way to leakage.

Priority Level

  • Nice-to-have.
    • There are a few nuances, but overall, it's not super hard to get the installation token.
    • Would just be nice to have the abstraction and not reinvent the wheel. Instead of countless organizations writing their own internal Action for local use, or using scripts in Actions contexts.
Lingua principale
JavaScript
Stelle
886
Fork
174
Nessuna PR unita negli ultimi 30g

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di actions/create-github-app-token

Tutte le issue di actions/create-github-app-token

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.