Skip to content

tokens: OS-14592 use GitHub app for token #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
t-bashir-bs wants to merge 6 commits into
base: main
Choose a base branch
from
Open

tokens: OS-14592 use GitHub app for token #2

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7a3290c
tokens: Add functionality to get the Github Token from a Github App w…
t-bashir-bs Feb 1, 2023
627a1e7
tokens: Add missing Github Token fetch if Github App used for stop case.
t-bashir-bs Feb 1, 2023
f48de4d
tokens: Forgot to commit dist/index.js from last commit
t-bashir-bs Feb 1, 2023
0fa8b18
config: Add a parameter to allow the EC2 runner to be left running af…
t-bashir-bs Feb 2, 2023
7f6e560
Get latest runner
caneraltinbasak Mar 2, 2026
3ef5e07
Update dist folder
caneraltinbasak Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 18 additions & 14 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,19 +21,20 @@ See [below](#example) the YAML code of the depicted workflow. <br><br>

**Table of Contents**

- [Use cases](#use-cases)
- [Access private resources in your VPC](#access-private-resources-in-your-vpc)
- [Customize hardware configuration](#customize-hardware-configuration)
- [Save costs](#save-costs)
- [Usage](#usage)
- [How to start](#how-to-start)
- [Inputs](#inputs)
- [Environment variables](#environment-variables)
- [Outputs](#outputs)
- [Example](#example)
- [Real user examples](#real-user-examples)
- [Self-hosted runner security with public repositories](#self-hosted-runner-security-with-public-repositories)
- [License Summary](#license-summary)
- [On-demand self-hosted AWS EC2 runner for GitHub Actions](#on-demand-self-hosted-aws-ec2-runner-for-github-actions)
- [Use cases](#use-cases)
- [Access private resources in your VPC](#access-private-resources-in-your-vpc)
- [Customize hardware configuration](#customize-hardware-configuration)
- [Save costs](#save-costs)
- [Usage](#usage)
- [How to start](#how-to-start)
- [Inputs](#inputs)
- [Environment variables](#environment-variables)
- [Outputs](#outputs)
- [Example](#example)
- [Real user examples](#real-user-examples)
- [Self-hosted runner security with public repositories](#self-hosted-runner-security-with-public-repositories)
- [License Summary](#license-summary)

## Use cases

Expand Down Expand Up @@ -192,7 +193,9 @@ Now you're ready to go!
| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | Required | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `mode` | Always required. | Specify here which mode you want to use: <br> - `start` - to start a new runner; <br> - `stop` - to stop the previously created runner. |
| `github-token` | Always required. | GitHub Personal Access Token with the `repo` scope assigned. |
| `github-token` | Either `github-token` or `github-app-private-key` is Always required. | GitHub Personal Access Token with the `repo` scope assigned. | |
`github-app-private-key` | Either `github-token` or `github-app-private-key` is Always required. | To avoid using a PAT token a Github App with 'repo' scope can be used (https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps) |
|`github-app-id` | Required if `github-app-private-key` is used. | If using a Github App to generate the token for runner registration, then the Github App Id is needed. |
Comment on lines +196 to +198
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Inputs markdown table is malformed here (missing leading/trailing | on some rows), which will break rendering. Reformat the added GitHub App rows so each row has the same number of columns and proper pipe delimiters.

Copilot uses AI. Check for mistakes.
| `ec2-image-id` | Required if you use the `start` mode. | EC2 Image Id (AMI). <br><br> The new runner will be launched from this image. <br><br> The action is compatible with Amazon Linux 2 images. |
| `ec2-instance-type` | Required if you use the `start` mode. | EC2 Instance Type. |
| `subnet-id` | Required if you use the `start` mode. | VPC Subnet Id. <br><br> The subnet should belong to the same VPC as the specified security group. |
Expand All @@ -202,6 +205,7 @@ Now you're ready to go!
| `iam-role-name` | Optional. Used only with the `start` mode. | IAM role name to attach to the created EC2 runner. <br><br> This allows the runner to have permissions to run additional actions within the AWS account, without having to manage additional GitHub secrets and AWS users. <br><br> Setting this requires additional AWS permissions for the role launching the instance (see above). |
| `aws-resource-tags` | Optional. Used only with the `start` mode. | Specifies tags to add to the EC2 instance and any attached storage. <br><br> This field is a stringified JSON array of tag objects, each containing a `Key` and `Value` field (see example below). <br><br> Setting this requires additional AWS permissions for the role launching the instance (see above). |
| `runner-home-dir` | Optional. Used only with the `start` mode. | Specifies a directory where pre-installed actions-runner software and scripts are located.<br><br> |
| `leave-ec2-instance-running` | Optional. Used only with the `stop` mode. | When `stop` mode is used only deregister the runner in Github and leave the instace running instead of terminating it.<br><br>This is a boolean.<br><br>This is useful if you need to debug failures that requires logging into the instance after the workflow completes. The instance can then be manually stopped or terminated after. |

### Environment variables

Expand Down
16 changes: 15 additions & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,16 @@ inputs:
github-token:
description: >-
GitHub Personal Access Token with the 'repo' scope assigned.
required: true
required: false
Comment on lines 14 to +17
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR updates src/* and adds new runtime dependencies, but the action entrypoint is dist/index.js (built via ncc). Ensure the compiled dist/index.js is regenerated and committed; otherwise the published action won’t include the GitHub App token and leave-instance-running changes.

Copilot uses AI. Check for mistakes.
github-app-private-key:
description: >-
To avoid using a PAT token a Github App with 'repo' scope can be used.
https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps
required: false
github-app-id:
description: >-
If using a Github App to generate the token for runner registration, then the Github App Id is needed.
required: false
ec2-image-id:
description: >-
EC2 Image Id (AMI). The new runner will be launched from this image.
Expand Down Expand Up @@ -74,6 +83,11 @@ inputs:
./svc.sh start
required: false
default: 'root'
leave-ec2-instance-running:
description: >-
When stop mode is used only deregister the runner in Github and leave the instace running instead of terminating it.
required: false
default: false
outputs:
label:
description: >-
Expand Down
Loading