feat: add support for enterprise-level GitHub Apps

.gitignore

@@ -1,3 +1,4 @@
 .env
 coverage
 node_modules/
+.DS_Store

README.md

@@ -195,6 +195,28 @@ jobs:
           body: "Hello, World!"
 ```
 
+### Create a token for an enterprise installation
+
+```yaml
+on: [workflow_dispatch]
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          enterprise-slug: my-enterprise-slug
+      - name: Call enterprise management REST API with gh
+        run: |
+          gh api /enterprises/my-enterprise-slug/apps/installable_organizations
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+```
+
 ### Create a token with specific permissions
 
 > [!NOTE]
@@ -353,6 +375,13 @@ steps:
 > [!NOTE]
 > If `owner` is set and `repositories` is empty, access will be scoped to all repositories in the provided repository owner's installation. If `owner` and `repositories` are empty, access will be scoped to only the current repository.
 
+### `enterprise-slug`
+
+**Optional:** The slug of the enterprise to generate a token for enterprise-level app installations.
+
+> [!NOTE]
+> The `enterprise-slug` input is mutually exclusive with `owner` and `repositories`. GitHub Apps can be installed on enterprise accounts with permissions that let them call enterprise management APIs. Enterprise installations do not grant access to organization or repository resources.
+
 ### `permission-<permission name>`
 
 **Optional:** The permissions to grant to the token. By default, the token inherits all of the installation's permissions. We recommend to explicitly list the permissions that are required for a use case. This follows GitHub's own recommendation to [control permissions of `GITHUB_TOKEN` in workflows](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token). The documentation also lists all available permissions, just prefix the permission key with `permission-` (e.g., `pull-requests` → `permission-pull-requests`).

action.yml

@@ -17,6 +17,9 @@ inputs:
   repositories:
     description: "Comma or newline-separated list of repositories to install the GitHub App on (defaults to current repository if owner is unset)"
     required: false
+  enterprise-slug:
+    description: "Enterprise slug for enterprise-level app installations (cannot be used with 'owner' or 'repositories')"
+    required: false
   skip-token-revoke:
     description: "If true, the token will not be revoked when the current job is complete"
     required: false

dist/main.cjs

@@ -23153,47 +23153,67 @@ async function pRetry(input, options = {}) {
 }
 
 // lib/main.js
-async function main(appId, privateKey, owner, repositories, permissions, core, createAppAuth2, request2, skipTokenRevoke) {
+async function main(appId, privateKey, enterpriseSlug, owner, repositories, permissions, core, createAppAuth2, request2, skipTokenRevoke) {
+  if (enterpriseSlug && (owner || repositories.length > 0)) {
+    throw new Error("Cannot use 'enterprise-slug' input with 'owner' or 'repositories' inputs");
+  }
   let parsedOwner = "";
   let parsedRepositoryNames = [];
-  if (!owner && repositories.length === 0) {
-    const [owner2, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
-    parsedOwner = owner2;
-    parsedRepositoryNames = [repo];
-    core.info(
-      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner2}/${repo}).`
-    );
-  }
-  if (owner && repositories.length === 0) {
-    parsedOwner = owner;
-    core.info(
-      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
-    );
-  }
-  if (!owner && repositories.length > 0) {
-    parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
-    parsedRepositoryNames = repositories;
-    core.info(
-      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories.map((repo) => `
+  if (!enterpriseSlug) {
+    if (!owner && repositories.length === 0) {
+      const [owner2, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
+      parsedOwner = owner2;
+      parsedRepositoryNames = [repo];
+      core.info(
+        `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner2}/${repo}).`
+      );
+    }
+    if (owner && repositories.length === 0) {
+      parsedOwner = owner;
+      core.info(
+        `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
+      );
+    }
+    if (!owner && repositories.length > 0) {
+      parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
+      parsedRepositoryNames = repositories;
+      core.info(
+        `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories.map((repo) => `
 - ${parsedOwner}/${repo}`).join("")}`
-    );
-  }
-  if (owner && repositories.length > 0) {
-    parsedOwner = owner;
-    parsedRepositoryNames = repositories;
-    core.info(
-      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
+      );
+    }
+    if (owner && repositories.length > 0) {
+      parsedOwner = owner;
+      parsedRepositoryNames = repositories;
+      core.info(
+        `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
       ${repositories.map((repo) => `
 - ${parsedOwner}/${repo}`).join("")}`
-    );
+      );
+    }
+  } else {
+    core.info(`Creating enterprise installation token for enterprise "${enterpriseSlug}".`);
   }
   const auth5 = createAppAuth2({
     appId,
     privateKey,
     request: request2
   });
   let authentication, installationId, appSlug;
-  if (parsedRepositoryNames.length > 0) {
+  if (enterpriseSlug) {
+    ({ authentication, installationId, appSlug } = await pRetry(
+      () => getTokenFromEnterprise(request2, auth5, enterpriseSlug, permissions),
+      {
+        shouldRetry: ({ error: error2 }) => error2.status >= 500,
+        onFailedAttempt: (context) => {
+          core.info(
+            `Failed to create token for enterprise "${enterpriseSlug}" (attempt ${context.attemptNumber}): ${context.error.message}`
+          );
+        },
+        retries: 3
+      }
+    ));
+  } else if (parsedRepositoryNames.length > 0) {
     ({ authentication, installationId, appSlug } = await pRetry(
       () => getTokenFromRepository(
         request2,
@@ -23270,6 +23290,32 @@ async function getTokenFromRepository(request2, auth5, parsedOwner, parsedReposi
   const appSlug = response.data["app_slug"];
   return { authentication, installationId, appSlug };
 }
+async function getTokenFromEnterprise(request2, auth5, enterpriseSlug, permissions) {
+  let response;
+  try {
+    response = await request2("GET /enterprises/{enterprise}/installation", {
+      enterprise: enterpriseSlug,
+      request: {
+        hook: auth5.hook
+      }
+    });
+  } catch (error2) {
+    if (error2.status === 404) {
+      throw new Error(
+        `No enterprise installation found matching the name ${enterpriseSlug}.`
+      );
+    }
+    throw error2;
+  }
+  const authentication = await auth5({
+    type: "installation",
+    installationId: response.data.id,
+    permissions
+  });
+  const installationId = response.data.id;
+  const appSlug = response.data["app_slug"];
+  return { authentication, installationId, appSlug };
+}
 
 // lib/request.js
 var baseUrl = getInput("github-api-url").replace(/\/$/, "");
@@ -23309,13 +23355,15 @@ async function run() {
   ensureNativeProxySupport();
   const appId = getInput("app-id");
   const privateKey = getInput("private-key");
+  const enterpriseSlug = getInput("enterprise-slug");
   const owner = getInput("owner");
   const repositories = getInput("repositories").split(/[\n,]+/).map((s) => s.trim()).filter((x) => x !== "");
   const skipTokenRevoke = getBooleanInput("skip-token-revoke");
   const permissions = getPermissionsFromInputs(process.env);
   return main(
     appId,
     privateKey,
+    enterpriseSlug,
     owner,
     repositories,
     permissions,
@@ -23327,7 +23375,9 @@ async function run() {
 }
 var main_default = run().catch((error2) => {
   console.error(error2);
-  setFailed(error2.message);
+  if (process.env.GITHUB_OUTPUT !== void 0) {
+    setFailed(error2.message);
+  }
 });
 /*! Bundled license information:
 

lib/main.js

@@ -4,6 +4,7 @@ import pRetry from "p-retry";
 /**
  * @param {string} appId
  * @param {string} privateKey
+ * @param {string} enterpriseSlug
  * @param {string} owner
  * @param {string[]} repositories
  * @param {undefined | Record<string, string>} permissions
@@ -15,58 +16,69 @@ import pRetry from "p-retry";
 export async function main(
   appId,
   privateKey,
+  enterpriseSlug,
   owner,
   repositories,
   permissions,
   core,
   createAppAuth,
   request,
-  skipTokenRevoke
+  skipTokenRevoke,
 ) {
-  let parsedOwner = "";
-  let parsedRepositoryNames = [];
-
-  // If neither owner nor repositories are set, default to current repository
-  if (!owner && repositories.length === 0) {
-    const [owner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
-    parsedOwner = owner;
-    parsedRepositoryNames = [repo];
-
-    core.info(
-      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner}/${repo}).`
-    );
-  }
-
-  // If only an owner is set, default to all repositories from that owner
-  if (owner && repositories.length === 0) {
-    parsedOwner = owner;
-
-    core.info(
-      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
-    );
-  }
-
-  // If repositories are set, but no owner, default to `GITHUB_REPOSITORY_OWNER`
-  if (!owner && repositories.length > 0) {
-    parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
-    parsedRepositoryNames = repositories;
-
-    core.info(
-      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
-        .map((repo) => `\n- ${parsedOwner}/${repo}`)
-        .join("")}`
-    );
+  // Validate mutual exclusivity of enterprise-slug with owner/repositories
+  if (enterpriseSlug && (owner || repositories.length > 0)) {
+    throw new Error("Cannot use 'enterprise-slug' input with 'owner' or 'repositories' inputs");
   }
 
-  // If both owner and repositories are set, use those values
-  if (owner && repositories.length > 0) {
-    parsedOwner = owner;
-    parsedRepositoryNames = repositories;
+  let parsedOwner = "";
+  let parsedRepositoryNames = [];
 
-    core.info(
-      `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
+  // Skip owner/repository parsing if enterprise-slug is set
+  if (!enterpriseSlug) {
+    // If neither owner nor repositories are set, default to current repository
+    if (!owner && repositories.length === 0) {
+      const [owner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
+      parsedOwner = owner;
+      parsedRepositoryNames = [repo];
+
+      core.info(
+        `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner}/${repo}).`
+      );
+    }
+
+    // If only an owner is set, default to all repositories from that owner
+    if (owner && repositories.length === 0) {
+      parsedOwner = owner;
+
+      core.info(
+        `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
+      );
+    }
+
+    // If repositories are set, but no owner, default to `GITHUB_REPOSITORY_OWNER`
+    if (!owner && repositories.length > 0) {
+      parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
+      parsedRepositoryNames = repositories;
+
+      core.info(
+        `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
+          .map((repo) => `\n- ${parsedOwner}/${repo}`)
+          .join("")}`
+      );
+    }
+
+    // If both owner and repositories are set, use those values
+    if (owner && repositories.length > 0) {
+      parsedOwner = owner;
+      parsedRepositoryNames = repositories;
+
+      core.info(
+        `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
       ${repositories.map((repo) => `\n- ${parsedOwner}/${repo}`).join("")}`
-    );
+      );
+    }
+  } else {
+    core.info(`Creating enterprise installation token for enterprise "${enterpriseSlug}".`);
   }
 
   const auth = createAppAuth({
@@ -76,9 +88,22 @@ export async function main(
   });
 
   let authentication, installationId, appSlug;
-  // If at least one repository is set, get installation ID from that repository
-
-  if (parsedRepositoryNames.length > 0) {
+
+  // If enterprise-slug is set, get installation ID from the enterprise
+  if (enterpriseSlug) {
+    ({ authentication, installationId, appSlug } = await pRetry(
+      () => getTokenFromEnterprise(request, auth, enterpriseSlug, permissions),
+      {
+        shouldRetry: ({ error }) => error.status >= 500,
+        onFailedAttempt: (context) => {
+          core.info(
+            `Failed to create token for enterprise "${enterpriseSlug}" (attempt ${context.attemptNumber}): ${context.error.message}`
+          );
+        },
+        retries: 3,
+      }
+    ));
+  } else if (parsedRepositoryNames.length > 0) {
     ({ authentication, installationId, appSlug } = await pRetry(
       () =>
         getTokenFromRepository(
@@ -181,3 +206,36 @@ async function getTokenFromRepository(
 
   return { authentication, installationId, appSlug };
 }
+
+async function getTokenFromEnterprise(request, auth, enterpriseSlug, permissions) {
+  let response;
+  try {
+    response = await request("GET /enterprises/{enterprise}/installation", {
+      enterprise: enterpriseSlug,
+      request: {
+        hook: auth.hook,
+      },
+    });
+  } catch (error) {
+    /* c8 ignore next 8 */
+    if (error.status === 404) {
+      throw new Error(
+        `No enterprise installation found matching the name ${enterpriseSlug}.`
+      );
+    }
+
+    throw error;
+  }
+
+  // Get token for the enterprise installation
+  const authentication = await auth({
+    type: "installation",
+    installationId: response.data.id,
+    permissions,
+  });
+
+  const installationId = response.data.id;
+  const appSlug = response.data["app_slug"];
+
+  return { authentication, installationId, appSlug };
+}