// the find
tibdex/github-app-token
Impersonate a GitHub App in a GitHub Action
A GitHub Action that mints short-lived installation tokens from a GitHub App's private key, solving the GITHUB_TOKEN limitation where workflow-triggered pushes don't re-trigger other workflows. Deprecated in favor of actions/create-github-app-token, so the main reason to look at it now is to understand how the pattern works or to migrate away.
The token revocation on job completion (post step) is a good practice that the action handles automatically, reducing the window where a leaked token can be abused. The installation retrieval options (by ID or by repository list) give reasonable flexibility without overcomplicating the interface. The permissions scoping parameter lets callers request a subset of the app's permissions, which is the right thing to do for least-privilege workflows.
It is deprecated — the README's first line says go use actions/create-github-app-token instead, so there is no reason to adopt this today. The codebase is minimal enough that it is essentially a thin wrapper around a couple of GitHub API calls; there is no meaningful error handling, retry logic, or rate-limit awareness. No tests in the test workflow for the actual token creation logic — the test.yml almost certainly just runs the action against real credentials, which is not a unit test.