Bug: actions/create-github-app-token cannot get repo

[jamesgeddes]

Select Topic Area

Question

Body

Hi All,

I am setting up a github bot for use with github actions, but it cannot access the repos API endpoint.

Here are the permissions that the bot is set to (way too permissive, I know, but I am just testing).

Here is my test action workflow

name: "test_gh_api"

on:
  workflow_dispatch:
  push:

permissions:
  id-token: write
  contents: write
  pull-requests: write
  packages: write
  actions: write
  checks: write


jobs:

  call_api:
    name: "Call GH API"
    runs-on: ubuntu-latest

    steps:
      - name: Generate GedBot token
        id: generate_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GEDBOT_APP_ID }}
          private-key: ${{ secrets.GEDBOT_PRIVATE_KEY }}

      - name: Checkout the code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}

      - name: Test GH API
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
        run: |
          echo "Running curl"
          curl --request GET \
            --header "Accept: application/vnd.github+json" \
            --header "Authorization: Bearer GITHUB_TOKEN" \
            --header "X-GitHub-Api-Version: 2022-11-28" \
            --url "https://api.github.com/repos/geddesfamily/estate-config"
          echo "Running GH CLI"
          gh api repos/geddesfamily/estate-config
          gh api repos/geddesfamily/estate-config/branches

I can confirm that geddesfamily/estate-config does exist.

This returns

Run echo "Running curl"
Running curl
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
{
100    90  100    90    0     0   1437      0 --:--:-- --:--:-- --:--:--  1451
  "message": "Bad credentials",
  "documentation_url": "https://docs.github.com/rest"
}
Running GH CLI
gh: Not Found (HTTP 404)
{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/repos#get-a-repository"}
Error: Process completed with exit code 1.

I feel like this covers all bases to mitigate the risk of the problem being cause by my idiocy, however it is always a possibility!

Is this a bug in the token gen step?

Also posted on actions/create-github-app-token#126

[KittyChiu]

It seems you have 3 processes going on within the call_api job:

1. 1st process used checkout, ie you are authenticating git CLI
2. 2nd process used curl, ie you are authenticating HTTP request
3. 3rd process tried to execute gh api GitHub CLI without authenticating at all

Unsure why you need to do a curl, but for gh api to work, you need to authenticate with gh auth login first.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬