feat: validate GitHub App permissions via API and add tests

[jcfr]

• Use octokit.rest.users.getByUsername to determine actor type (User or Bot)
• Fetch GitHub App installation details with octokit.rest.apps.getRepoInstallation for permission validation.
• Ensure GitHub Apps have "issues" permission set to "write" before allowing execution.
• Add test cases for GitHub App actors

[jcfr]

In the context of the https://github.com/MorphoCloud/MorphoCloudWorkflow project, it would be very convenient to allow triggering workflow after our dedicated GitHub App user comment¹ on issue. Despite of being added to the allowList, we observed the error depicted below. This pull request is an attempt to address this.

Footnotes

1. https://github.com/MorphoCloud/MorphoCloudInstancesTest/issues/131#issuecomment-2689506170 ↩

[GrantBirki]

@jcfr Thank you for this! 🚀

I can see right away how this could be useful. Pretty much how I build these Actions is always allowing for users to toggle on/off features like this so I pushed a commit to add a new allow_github_apps input to disable this ability if people want to do so. By default, it will be enabled so both users and bots can trigger this Action (making this a non-breaking change).

I also did the following:

• Fixed a few tests
• Added a few more tests for 100% unit test coverage
• Added a new output called actor_type which matches the type of the Actor who initiated the chatop request

[GrantBirki]

@jcfr I think these changes should be good to merge in shortly.

Could I ask that you briefly fill out some docs around using GitHub Apps with this Action so that others who want to do the same have a bit of info/context to go off of? I created a new doc here for you to add some notes. Thank you!

https://github.com/github/command/pull/70/files#diff-2c3a4fa30fdb6b666b88487547e39ac628a80976a03a0332c78468aae5e8a90bR5

[GrantBirki]

Also, for testing you could likely point a previous using of github/command to this PR branch and see if it works before we merge as well.

For example you could do:

- uses: jcfr/command@support-granting-permission-to-bot-user

and that should work by using this branch

[jcfr]

Thanks for both the quick review and for bringing this patch to the next level 🙏 🚀

Adding support for allow_github_apps as input as well as the actor_type as output is very sensible.

Also, for testing you could likely point [...] uses: jcfr/command@support-granting-permission-to-bot-user

I will test in the morning and report back.

fill out some docs around using GitHub Apps with this Action so that others who want to do the same have a bit of info/context to go off of?

I will do so. Thanks for the suggestion.

[jcfr]

At first, I observed the following:

https://github.com/MorphoCloud/MorphoCloudInstancesTest/actions/runs/13609717922/job/38045333779

Then, I explicitly associated the token retrieved from the Github App with the github/command by setting github_token input (see MorphoCloud/MorphoCloudInstancesTest@9c2e5d9), but I still observe the same error:

https://github.com/MorphoCloud/MorphoCloudInstancesTest/actions/runs/13609779093/job/38045452436

I am wondering if I should grant additional permission to the GitHub App ..

[GrantBirki]

@jcfr I think that perhaps we are going about this the wrong way. The octokit.rest.apps.getRepoInstallation() method expects to be called from an authenticated GitHub App client. This isn't really what you likely want as then you have to pass in the same credentials of the GitHub App into the github/command Action.

That would be unnecessary as you are only trying to check to see if the GitHub App has proper permissions to interact with this repo in the same way that the Action checks if Users have the correct permissions.

I should have caught this earlier as a different approach will need to be taken.

I feel like there certainly has to be a way to check the permissions of a GitHub App on a repo without having to authenticate as the GitHub App itself but I don't know off the top of my head 🤔.

[GrantBirki]

Doing a very brief search I don't see anything jumping out to me right away to see if it is possible to figure out if a GitHub App has "proper permissions" to interact with a repository in this sense.

Note: I did not do an extensive search

If it turns out that there isn't a solid way to check the permissions of a GitHub App without directly authenticating as it, you might have to get creative here.

Some potential ideas could be a new input called: allowed_github_apps: monalisa[bot],someother[bot]. Then users would simply configure an explicit allowlist of GitHub Apps that they trust and be able to invoke workflows using the github/command Action.

Just a thought.. might have to go low tech to get this to work.

[jcfr]

Thanks for following up and for looking into ways of addressing this 🙏

I feel like there certainly has to be a way to check the permissions of a GitHub App on a repo without having to authenticate as the GitHub App itself

Ditto. That would be ideal.

If it turns out that there isn't a solid way to check the permissions of a GitHub App without directly authenticating as it, you might have to get creative here.
Some potential ideas could be a new input called: allowed_github_apps: monalisa[bot],someother[bot]. Then users would simply configure an explicit allowlist of GitHub Apps that they trust and be able to invoke workflows using the github/command Action.

That seems reasonable.

And this could be done by either explicitly passing my-awesome[bot] or by using the app-slug output of the actions/create-github-app-token action.

      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
        id: app-token
        with:
          app-id: ${{ vars.MY_AWESOME_WORKFLOW_APP_ID }}
          private-key: ${{ secrets.MY_AWESOME_WORKFLOW_APP_PRIVATE_KEY }}
          
      - name: awesome command
        id: awesome_command
        uses: github/command@vX.Y.Z
        with:
          command: "/awesome"
          reaction: "rocket"
          allowed_contexts: "issue"
          permissions: "read,triage,write,maintain,admin"
          allowlist:
            "${{ steps.app-token.outputs.app-slug }}[bot]"

[GrantBirki]

I think explicitly passing my-awesome[bot] would be the best way to do so as not everyone would be using the app slug in combination with the actions/create-github-app-token job.

This seems like the best way forward to me.

[jcfr]

I think explicitly passing my-awesome[bot] [...] best way

I started updating the PR this weekend and I will try to get that finalized asap.

Thanks for the patience :pray