What is the minimum required permissions for GitHub App

[dmfrey]

There is no guidance on the minimum required permissions when creating the new GitHub App in step 1 of using this Action. Could that be clarified somewhere?

[gr2m]

There are no minimal required permissions as far as I know. It might be that the meta permission is required as a minimum but I'm not sure. The permissions you need depend on what you need to do with the token.

Could you try if the action works with an app that does not have any permissions enabled?

[evankanderson]

You need "Repository Metadata: read" permission on your app, as well as whatever other permissions the app needs. If you don't have that read permission, you will get the following error:

Failed to create token for "community" (attempt 4): Not Found - https://docs.github.com/rest/apps/apps#get-a-repository-installation-for-the-authenticated-app
RequestError [HttpError]: Not Found - https://docs.github.com/rest/apps/apps#get-a-repository-installation-for-the-authenticated-app
    at fetchWrapper (/home/runner/work/_actions/actions/create-github-app-token/v1/dist/main.cjs:37109:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async hook4 (/home/runner/work/_actions/actions/create-github-app-token/v1/dist/main.cjs:39476:[18](https://github.com/mindersec/community/actions/runs/11299437602/job/31430366905#step:5:19))
    at async getTokenFromRepository (/home/runner/work/_actions/actions/create-github-app-token/v1/dist/main.cjs:39792:20)
    at async RetryOperation._fn (/home/runner/work/_actions/actions/create-github-app-token/v1/dist/main.cjs:39667:24) {
  status: 404,
  request: {
    method: 'GET',
    url: 'https://api.github.com/repos/mindersec/community/installation',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'actions/create-github-app-token',
      authorization: 'bearer [REDACTED]'
    },
    request: { hook: [Function: bound hook4] AsyncFunction }
  },
  response: {
    url: 'https://api.github.com/repos/mindersec/community/installation',
    status: 404,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 11 Oct 2024 21:22:23 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': 'E440:2DD0B0:15F8F16:16[26](https://github.com/mindersec/community/actions/runs/11299437602/job/31430366905#step:5:27)E59:6709970B',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Not Found',
      documentation_url: 'https://docs.github.com/rest/apps/apps#get-a-repository-installation-for-the-authenticated-app',
      status: '404'
    }
  },

Source: https://github.com/mindersec/community/actions/runs/11299437602/job/31430366905
(I ran across this setting up Terraform for managing a new OpenSSF foundation project)

(I'm including the full error message, because the action run will eventually be cleaned up, and I'd like search engines to be able to help the next person later.)

[jackivanov]

You need "Repository Metadata: read" permission on your app, as well as whatever other permissions the app needs. If you don't have that read permission, you will get the following error:

This needs to be marked as the answer and then documented in the README.md. Otherwise people are forced to reverse engineer or "guess" the permissions required.

[gr2m]

good idea, cheers! Pull request welcome!

#205 (comment)

[gr2m]

Thanks for confirming!

We should document that the meta:read is the minimal required permission for the action to work, pull request welcome 👋🏼