Generate GitHub App tokens internally in reusable workflows

Replace auth_token secret with app_id + app_private_key.  Each
reusable workflow now generates its own short-lived installation
token using actions/create-github-app-token, eliminating the need
for consumers to manage token lifecycle.

Consumers store REPO_SYNC_APP_ID and REPO_SYNC_APP_PRIVATE_KEY as
repo secrets (long-lived), and the workflows handle the rest.

Co-Authored-By: Oz <oz-agent@warp.dev>

Author: vorporeal

.github/workflows/escalation.yml

@@ -32,8 +32,11 @@ on:
         required: true
         type: string
     secrets:
-      auth_token:
-        description: "GitHub App installation token with cross-repo push and PR permissions."
+      app_id:
+        description: "GitHub App ID."
+        required: true
+      app_private_key:
+        description: "GitHub App private key."
         required: true
 
 jobs:
@@ -44,14 +47,21 @@ jobs:
       pull-requests: write
       actions: write
     env:
-      GH_TOKEN: ${{ secrets.auth_token }}
       ESCALATE_TO: ${{ inputs.escalate_to }}
       ESCALATE_AFTER: ${{ inputs.escalate_after }}
     steps:
+      - name: Generate installation token
+        id: token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.app_id }}
+          private-key: ${{ secrets.app_private_key }}
+          owner: ${{ github.repository_owner }}
+      - run: echo "GH_TOKEN=${{ steps.token.outputs.token }}" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-        with: { token: "${{ secrets.auth_token }}" }
+        with: { token: "${{ steps.token.outputs.token }}" }
       - uses: actions/checkout@v4
-        with: { repository: warpdotdev/repo-sync, ref: v1, path: .repo-sync, token: "${{ secrets.auth_token }}" }
+        with: { repository: warpdotdev/repo-sync, ref: v1, path: .repo-sync, token: "${{ steps.token.outputs.token }}" }
       - uses: actions/setup-python@v5
         with: { python-version: "3.12" }
       - run: pip install -e .repo-sync

.github/workflows/restack.yml

@@ -25,14 +25,13 @@ on:
         type: string
         default: "@oncall-client-primary"
     secrets:
-      auth_token:
-        description: "GitHub App installation token with cross-repo push and PR permissions."
+      app_id:
+        description: "GitHub App ID."
         required: true
-  # workflow_dispatch is used for stuck-stack recovery.  GitHub Actions does
-  # not support secrets under workflow_dispatch, so the dispatched run must
-  # generate its own token (e.g. via actions/create-github-app-token).  The
-  # consuming repo should store REPO_SYNC_APP_ID and
-  # REPO_SYNC_APP_PRIVATE_KEY as repo-level secrets.
+      app_private_key:
+        description: "GitHub App private key."
+        required: true
+  # workflow_dispatch is used for stuck-stack recovery.
   workflow_dispatch:
     inputs:
       pr_number:
@@ -75,38 +74,32 @@ jobs:
       PRIVATE_REPO: ${{ inputs.private_repo }}
       ESCALATE_TO: ${{ inputs.escalate_to }}
     steps:
-      # For workflow_dispatch, generate a token since secrets aren't available.
-      # For workflow_call, use the passed auth_token.
-      - name: Generate token (workflow_dispatch)
-        if: github.event_name == 'workflow_dispatch'
-        id: gen_token
+      # Generate a token for both workflow_call and workflow_dispatch.
+      # For workflow_call, secrets are passed from the caller.
+      # For workflow_dispatch, secrets come from the repo's own secrets.
+      - name: Generate installation token
+        id: token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.REPO_SYNC_APP_ID }}
-          private-key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
+          app-id: ${{ secrets.app_id || secrets.REPO_SYNC_APP_ID }}
+          private-key: ${{ secrets.app_private_key || secrets.REPO_SYNC_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-
       - name: Set GH_TOKEN
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "GH_TOKEN=${{ steps.gen_token.outputs.token }}" >> "$GITHUB_ENV"
-          else
-            echo "GH_TOKEN=${{ secrets.auth_token }}" >> "$GITHUB_ENV"
-          fi
+        run: echo "GH_TOKEN=${{ steps.token.outputs.token }}" >> "$GITHUB_ENV"
 
       - name: Checkout repo
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ env.GH_TOKEN }}
+          token: ${{ steps.token.outputs.token }}
 
       - name: Checkout repo-sync tooling
         uses: actions/checkout@v4
         with:
           repository: warpdotdev/repo-sync
           ref: v1
           path: .repo-sync
-          token: ${{ env.GH_TOKEN }}
+          token: ${{ steps.token.outputs.token }}
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/sync.yml

@@ -26,7 +26,11 @@ on:
         type: string
         default: ""
     secrets:
-      auth_token:
+      app_id:
+        description: "GitHub App ID."
+        required: true
+      app_private_key:
+        description: "GitHub App private key."
         required: true
 
 concurrency:
@@ -37,17 +41,25 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.auth_token }}
       PUBLIC_REPO: ${{ inputs.public_repo }}
       PRIVATE_REPO: ${{ inputs.private_repo }}
     steps:
+      - name: Generate installation token
+        id: token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.app_id }}
+          private-key: ${{ secrets.app_private_key }}
+          owner: ${{ github.repository_owner }}
       - uses: actions/checkout@v4
-        with: { fetch-depth: 0, token: "${{ secrets.auth_token }}" }
+        with: { fetch-depth: 0, token: "${{ steps.token.outputs.token }}" }
       - uses: actions/checkout@v4
-        with: { repository: warpdotdev/repo-sync, ref: v1, path: .repo-sync, token: "${{ secrets.auth_token }}" }
+        with: { repository: warpdotdev/repo-sync, ref: v1, path: .repo-sync, token: "${{ steps.token.outputs.token }}" }
       - uses: actions/setup-python@v5
         with: { python-version: "3.12" }
       - run: pip install -e .repo-sync
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.token.outputs.token }}" >> "$GITHUB_ENV"
 
       # Derive peer_repo and source_is_private from the two repo names.
       - name: Derive sync context
@@ -98,7 +110,7 @@ jobs:
           ref: ${{ github.event.repository.default_branch }}
           path: peer
           fetch-depth: 0
-          token: ${{ secrets.auth_token }}
+          token: ${{ steps.token.outputs.token }}
 
       - name: Find existing stack top
         if: steps.unsynced.outputs.count != '0'

README.md

@@ -44,7 +44,7 @@ the marker lines and everything between them are stripped.  markers must be prop
 
 before integrating, ensure the consuming repos have:
 
-1. **a GitHub App** installed on both repos with `contents:write`, `pull_requests:write`, and `metadata:read` permissions.  store the App ID and private key as repo secrets (`REPO_SYNC_APP_ID`, `REPO_SYNC_APP_PRIVATE_KEY`).
+1. **a GitHub App** installed on both repos (and on the `repo-sync` repo itself) with `contents:write`, `pull_requests:write`, `workflows:write`, and `metadata:read` permissions.  store the App ID and private key as repo secrets (`REPO_SYNC_APP_ID`, `REPO_SYNC_APP_PRIVATE_KEY`) in both repos.  the reusable workflows generate short-lived installation tokens internally.
 2. **auto-merge enabled** as a repo-level setting.
 3. **squash merge** as the merge strategy for PRs, configured to **preserve the PR description** in the commit message.
 4. **branch protection rules** on `repo-sync/*` branches, so only the sync workflow's token can create or push to them.
@@ -114,7 +114,8 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   restack:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'repo-sync/')
@@ -123,7 +124,8 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   escalation:
     if: github.event_name == 'schedule'
@@ -134,7 +136,8 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 ```
 
 the same workflow file works in both repos -- the workflows derive which repo is which by comparing `github.repository` against the `private_repo` input.

examples/consuming-repo-sync.yml

@@ -6,8 +6,9 @@
 # Prerequisites for the consuming repo:
 #   - A GitHub App installed on both repos with contents:write, pull_requests:write,
 #     and metadata:read permissions.
-#   - A GitHub App installation token stored as a repository secret (REPO_SYNC_TOKEN).
-#     Generate it using the App's ID and private key, or use a fine-grained PAT.
+#   - The App's ID and private key stored as repository secrets (REPO_SYNC_APP_ID,
+#     REPO_SYNC_APP_PRIVATE_KEY).  The reusable workflows generate short-lived
+#     installation tokens internally.
 #   - Auto-merge enabled as a repo-level setting.
 #   - Squash merge configured to preserve the PR description in the commit message.
 #   - Branch protection rules on repo-sync/* branches (only the sync workflow's
@@ -45,7 +46,8 @@ jobs:
       escalate_to: "@oncall-client-primary"
       # slack_webhook_url: ${{ secrets.REPO_SYNC_SLACK_WEBHOOK }}
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   # -----------------------------------------------------------------------
   # Restack: triggered when a sync PR is merged.
@@ -61,7 +63,8 @@ jobs:
       private_repo: warpdotdev/warp-internal
       escalate_to: "@oncall-client-primary"
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   # -----------------------------------------------------------------------
   # Escalation cron: runs on schedule.
@@ -75,4 +78,5 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
     secrets:
-      auth_token: ${{ secrets.REPO_SYNC_TOKEN }}
+      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
+      app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}