Installing the ARC on multiple orgs using GH App authentication

Hi, team. 👋 I'm working on setting the ARC up for a high profile customer, and we're running into an issue that I'm not sure how to get past.

We have successfully configured the ARC for a single org using the GH App authentication method. We're using the webhook on the GH App to trigger the autoscaling of the runner pods. We're now trying to enable this for their other orgs, so we made the app public and the installed it on a second org. We then deployed a second runner-deployment.yaml that contains the second org, and I can see in the "describe runner" output that it is unable to update the registration token for this other org. I can also see the "403 Resource not accessible by integration" error in the controller pod logs. I believe this is due to the fact that GH App installation ID for the second org is unique and doesn't match the installation ID that is stored in the controller-manager secret in the actions-runner-system namespace.

What is the proper method of getting this installed across multiple orgs? My customer does not want to use PAT authentication to avoid having to rotate the service account every six months that would be associated with the PAT. And as far as I'm aware, you can't install the GH App at the enterprise level.

Start by reviewing the runner-deployment.yaml configuration, the controller-manager secret in the actions-runner-system namespace, and the describe runner output and controller pod logs. Trace how the GitHub App installation ID is used for the second organization and confirm what the 403 error indicates. Done means identifying and documenting the supported multi-organization installation method without relying on a PAT.