Transitioning from Personal Access Token to GitHub App for Authentication

[maltif]

We currently face GitHub API rate limit issues while collecting and visualizing GitHub metrics for our company's private repositories using GrimoireLab. We have around 1500 private repositories and are collecting various metrics such as git commits, GitHub pull requests data, and GitHub issues.

To address the API rate limit issue, we plan to transition from using a personal access token (PAT) to GitHub App-based authentication. However, we lack clarity on how to configure this transition within GrimoireLab and what permissions are required for the GitHub App to pull all the necessary metrics from our private repositories.

We've reviewed the GrimoireLab documentation, particularly the tutorial section, but couldn't find sufficient guidance on this specific topic.

Objectives:

1. Understand the process of transitioning from PAT to GitHub App-based authentication within GrimoireLab.
2. Determine the required permissions for the GitHub App to access and retrieve metrics from our private repositories.

Proposed Questions for Discussion:

1. Could someone provide guidance on how to configure GrimoireLab to use GitHub App-based authentication instead of a personal access token?
2. Are the repository permissions listed below sufficient for the GitHub App to effectively collect all the required metrics from our private repositories?
   • Actions: Read Only
   • Commit Statuses: Read Only
   • Contents: Read Only
   • Environments: Read Only
   • Merge Queues: Read Only
   • Metadata: Read Only
   • Pull Requests: Read Only
   • Discussions: Read Only
   • Issues: Read Only
   • Secrets: Read Only
   • Variables: Read Only
3. Are there any specific considerations or best practices we should be aware of during this transition process?

Additional Context:

We believe transitioning to GitHub App-based authentication will alleviate the API rate limit issues we're currently facing and ensure smoother data collection for our metrics analysis. Any insights or assistance from the Grimoire project maintainers or knowledgeable community members would be greatly appreciated.

Thank you in advance for your assistance.
@zhquan @sduenas