Document limitations of using App Installation Tokens with GitHub Packages

[micimize]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

To my knowledge all "Working With" guides under https://docs.github.com/en/packages/working-with-a-github-packages-registry are affected

What part(s) of the article would you like to see updated?

Instead of specifying the fact that App Installation tokens don't work with some registries, the docs make no mention of them. Thus, an integration developer is left to discover that app installation token with package read permissions cannot read (at least) npm and maven packages from an error response:

npm ERR! code E401
npm ERR! 401 Unauthorized - GET https://npm.pkg.github.com/@myorg%2fpkg - This credential type is not supported for registry. Please use a Personal Access Token or GitHub Actions token instead.

Adding a note like the following would be good:

Note: GitHub App Installation Tokens are not currently supported by Maven, NPM, ..., or GHCR registries.

[ramyaparimi]

@micimize
Thanks so much for opening an issue! I'll triage this for the team to take a look 👀

[micimize]

We have found more undocumented limitations of github app user-to-server tokens. Some graphql routes will respond with Resource not accessible by integration, and they cannot actually make some actions on behalf of users when the app has appropriate permissions such as unsubscribing from watched repositories.

Edit: nevermind, there is a list of rest endpoints https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps