GitHub App

**Name of app / service**
GitHub App

**Link to developer documentation**
- https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys#github-app-installation-access-tokens
- https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation#about-authentication-as-a-github-app-installation
- https://github.com/peter-murray/workflow-application-token-action

**Here is how we do something similar with `bash`:**

```
#!/bin/bash

# requires `jq`

set -o pipefail

re='^[0-9]+$'
if ! [[ $1 =~ $re ]] ; then
echo "error: App installation ID needs to be a number" >&2; exit 1
fi

installation_id=$1

# Change these variables:
app_id=1
app_private_key="
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
"
api_base="https:///api.github.com/api/v3"

# Shared content to use as template
header='{
"alg": "RS256",
"typ": "JWT"
}'
payload_template='{}'

build_payload() {
jq -c \
--arg iat_str "$(date +%s)" \
--arg app_id "${app_id}" \
'
($iat_str | tonumber) as $iat
| .iat = $iat
| .exp = ($iat + 300)
| .iss = ($app_id | tonumber)
' <<< "${payload_template}" | tr -d '\n'
}

b64enc() { openssl enc -base64 -A | tr '+/' '-_' | tr -d '='; }
json() { jq -c . | LC_CTYPE=C tr -d '\n'; }
rs256_sign() { openssl dgst -binary -sha256 -sign <(printf '%s\n' "$1"); }

sign() {
local algo payload sig
algo=${1:-RS256}; algo=${algo^^}
payload=$(build_payload) || return
signed_content="$(json <<<"$header" | b64enc).$(json <<<"$payload" | b64enc)"
sig=$(printf %s "$signed_content" | rs256_sign "$app_private_key" | b64enc)
printf '%s.%s\n' "${signed_content}" "${sig}"
}

github_api_url="${api_base}/app/installations/${installation_id}/access_tokens"
curl -s -X POST \
-H "Authorization: Bearer $(sign)" \
-H "Accept: application/vnd.github.v3+json" \
"${github_api_url}" \
| jq -cr .token
```

**Is lack of support preventing you from building workflows, or do you have a workaround?**
There are less ideal work-arounds. Authentication as a GitHub application would allow better security for organization level security. It is easier to maintain than personal account connections or machine accounts. We use this approach in our GitHub Actions. Someone even created a nice GitHub action for it specifically. See third link above: peter-murray/workflow-application-token-action

**Are there specific actions, or triggers, you'd like to see for this app? Please let us know here or use the Action and Trigger issue templates to open requests for each!**
Nearly all GitHub actions should work with GitHub App authentication, if the correct permissions are assigned to the GitHub App.
It's a little more complicated to set up overall, but independent of any individual accounts.