Dashboard › publish › Distillation
93b2ad8a-52e0-4cc3-af5a-6ba96cb198e7["lore_tm_v1_ZeSZSGNnhQ37vVzgbfHFswkq9ngjp9HV0PjgnZO1wLc","lore_tm_v1_0SBlpG1rn38uPK1E4pibZPEUnU68yERedSsbc7smhSU","lore_tm_v1_4Eh3KqXaFKPe4R8ATFkleB8Y31ML3BYqXGSP7JJWGIg","lore_tm_v1_UaDCrFgnhZ2XU1RoYB3mAoG55zkFZtjJ5Z3pI4VyvtM","lore_tm_v1_E5mqor7BAyzmsI0bne-lwM1sC3W-3bNrmEwpSi8laOE"]
Date: Sep 9, 2026
actions/create-github-app-token metadata identifies the action as “Create GitHub App Token,” authored by Gregor Martynus and Parker Brown; it runs on node24 with dist/main.cjs and post-step dist/post.cjs, and outputs token, installation-id, and app-slug.actions/create-github-app-token requires private-key; supports client-id, deprecated app-id, owner, comma/newline-separated repositories, mutually exclusive enterprise, skip-token-revoke defaulting to "false", and configurable github-api-url defaulting to ${{ github.api_url }}.actions/create-github-app-token exposes granular installation-token permission inputs including repository permissions (actions, administration, artifact-metadata, attestations, checks, codespaces, contents, deployments, discussions, environments, interaction-limits, issues, merge-queues, metadata, packages, pages, pull-requests, repository-custom-properties, repository-hooks, repository-projects, secret-scanning-alerts, secrets, security-events, single-file, statuses, vulnerability-alerts, workflows), organization/enterprise permissions, and user permissions such as email-addresses, followers, git-ssh-keys, gpg-keys, profile, and starring; most accept read or write, selected project/custom-property inputs also accept admin, and permission-workflows accepts write.users/get-authenticated has operationId: "users/get-authenticated", fineGrainedAccess: null, enabledForGitHubApps: false, and githubCloudOnly: false; therefore GitHub App installation tokens cannot use GET /user through this operation.src/modules/__tests__/approval-authorizer.js tests that authorizeApproval() rejects direct approval by getsantry[bot] and sentry-release-bot[bot] without calling the target-repository permission lookup; rejects getsantry[bot] when getsentry/sentry-javascript is outside the allowlist; accepts exact roles write, maintain, and admin; rejects none, read, triage, "Elevated Bot", and undefined; resolves unqualified publish: sentry-javascript/packages/core@10.0.0 to getsentry/sentry-javascript; rejects malformed titles without querying GitHub; and propagates a permission lookup error "Not Found" (src/modules/__tests__/approval-authorizer.js:1-147).src/modules/__tests__/approval-attestation.js tests that the greatest accepted label event ID ("200" over "100") matches a trusted github-actions[bot] approval attestation; numeric GitHub event ID 29503999078 is normalized to string "29503999078"; CI-ready proof is rejected if the accepted event changes from ID "200" to "201" or the CI-ready actor changes from sentry-internal-app[bot] to contractor; malformed base64 proof returns null; and changing the request to dry-run invalidates its attestation (src/modules/__tests__/approval-attestation.js:1-174).src/publish/__tests__/authorize-approval.js uses runAuthorization() with GITHUB_OUTPUT=/tmp/github-output, APPROVAL_ACTOR, APPROVAL_ISSUE_NUMBER=123, APPROVAL_ISSUE_REPOSITORY=getsentry/publish, and APPROVAL_ISSUE_TITLE; it mocks fs.appendFileSync and sequential fetch responses, then waits for output (src/publish/__tests__/authorize-approval.js:11-43).src/publish/__tests__/authorize-approval.js verifies exact allowlist path loading from getsentry/sentry-javascript and getsentry/objectstore/clients; a successful write permission lookup for contractor calls https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission and emits authorized=true plus a <!-- publish-approval ... --> attestation (src/publish/__tests__/authorize-approval.js:45-94).authorize-approval entry-point tests verify: 1. self-approval by requester contractor emits authorized=false; 2. an allowlisted getsantry[bot] request labeled accepted by sentry-internal-app[bot] is authorized only with a github-actions[bot] request proof and without a collaborator lookup; 3. missing request proof emits authorized=false; 4. direct approval by sentry-release-bot[bot] performs no fetch and emits authorized=false; 5. a GitHub permission response with status 404 throws Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404 and writes no output (src/publish/__tests__/authorize-approval.js:96-236).