GitHub Appを作成

<!-- # GitHub App-->

<!--GitHub Appでできること -->

# 権限

> By default, only organization owners can manage the settings of GitHub Apps in an organization. To allow additional users to change the developer settings of GitHub Apps owned by the organization, an owner can grant them GitHub App manager permissions.

[ref](https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps)

- Org ownersが必要
- Orgで管理しているGitHub Appの権限だけを付与することも可能

# GitHub App作成例

https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app

## GitHub Actionsで、変更が必要であればCommitをPushしてPRを作成するApp

:::note info
やる理由は、普通のGitHub Actions Tokenで commitするとGitHub Actionsがトリガーされないので単純に `GITHUB_TOKEN`でGitHub Actionsを実行するのではなくGitHub Appを使う。
:::

テストAppを作成


![Screenshot 2024-10-27 at 21.11.53.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/a4ba81fa-bbd9-1255-c8f6-22fa12c36d62.png)

Webhookは不要

![Screenshot 2024-10-27 at 21.12.59.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/26effe92-05e2-ceba-742b-a7a295dcc4d8.png)

権限

Pushするので、ContentsのRead and Write権限を付与

![Screenshot 2024-10-27 at 21.13.38.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/3b378c2a-5bac-2348-cfee-312a175103a5.png)

Pull Requestの作成用も付与

![Screenshot 2024-10-28 at 10.42.32.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/923e74cd-af25-3ecb-f302-4022ba9cf7f9.png)


とりあえずAccount以下のみ

![Screenshot 2024-10-27 at 21.14.20.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/040563c3-a502-9a33-f69b-614dedad8785.png)

作成完了すると以下がゲットできる

- App ID
- Client ID


インストールする

![Screenshot 2024-10-28 at 10.12.08.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/4ed967ef-d1dc-fa51-9c83-eb99635ccefa.png)

今回はまず `github-actions-practice` だけにインストールする。

![Screenshot 2024-10-28 at 10.13.02.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/4055dba5-111b-95f8-7b58-e72633057ad4.png)

インストール完了

![Screenshot 2024-10-28 at 10.14.31.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/30435164-005a-cdc1-ba83-ed667a01b84b.png)


Private keyが必要なので生成する。生成すると `<app名>.<date>.private-key.pem`というファイルがダウンロードされる。

```
cat nakamasato-test-app.2024-10-28.private-key.pem
```

これで秘密鍵を取得できる。次のステップでGitHub Repository secretsに登録する。

![Screenshot 2024-10-28 at 10.11.12.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/8e026f7b-dd7b-1cb5-bdbb-b62dbb58295d.png)


GitHub AppをGitHub Actionsで使う

上記で作成したprivate keyをrepository secretにいれる

今回は`GH_TEST_APP_ID`と`GH_TEST_PRIVATE_KEY`にいれた。

![Screenshot 2024-10-28 at 10.34.24.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/9273a77e-15f7-5f74-e519-8b162b85a256.png)

Tokenを得るためには以下のStepで可能

https://github.com/actions/create-github-app-token

```yaml
      - name: create-github-app-token
        if: steps.date_check.outputs.updated == 'true'
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_TEST_APP_ID }}
          private-key: ${{ secrets.GH_TEST_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
```

以下のGitHub Actionsで、GitHub ActionsのTokenをそのまま使った場合との比較を見ることができる。

```yaml
name: create-pull-request

on:
  push:
    branches:
      - main

jobs:
  create-pr-with-github-token:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check and Update Date
        id: date_check
        run: |
          TODAY=$(date +"%Y-%m-%d")
          FILE_DATE=$(cat updated_on.txt || echo "")
          if [ "$FILE_DATE" != "$TODAY" ]; then
            echo "$TODAY" > updated_on.txt
            echo "updated=true" >> "$GITHUB_OUTPUT"
          else
            echo "updated=false" >> "$GITHUB_OUTPUT"
          fi
      # GitHub Actions are NOT triggered in this PR
      - name: create-pull-request
        if: steps.date_check.outputs.updated == 'true'
        uses: peter-evans/create-pull-request@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: 'chore: update updated_on (github token)'
          branch: update-updated-on-github-token
          title: 'chore: update updated_on (github token)'
          body: 'Update updated_on automatically (github token)'
          base: main
          delete-branch: true

  create-pr-with-github-app:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check and Update Date
        id: date_check
        run: |
          TODAY=$(date +"%Y-%m-%d")
          FILE_DATE=$(cat updated_on.txt || echo "")
          if [ "$FILE_DATE" != "$TODAY" ]; then
            echo "$TODAY" > updated_on.txt
            echo "updated=true" >> "$GITHUB_OUTPUT"
          else
            echo "updated=false" >> "$GITHUB_OUTPUT"
          fi
      - name: create-github-app-token
        if: steps.date_check.outputs.updated == 'true'
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_TEST_APP_ID }}
          private-key: ${{ secrets.GH_TEST_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      # GitHub Actions are triggered in this PR
      - name: create-pull-request
        if: steps.date_check.outputs.updated == 'true'
        uses: peter-evans/create-pull-request@v5
        with:
          token: ${{ steps.app-token.outputs.token }}
          commit-message: 'chore: update updated_on (github app)'
          branch: update-updated-on-github-app
          title: 'chore: update updated_on (github app)'
          body: 'Update updated_on automatically (github app)'
          base: main
          delete-branch: true
```

結果:

![Screenshot 2024-10-28 at 11.17.13.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/7059/9d7055e6-535e-4d28-b38b-3fe3511ba54d.png)

想定通り、GitHub Appで作成したPRはGitHub Actionsが普通のPRと同様に実行されている事がわかります。

:::note warn
GitHub PRをエンドレスに作るGitHub Actionsにならないように注意が必要です。
:::

## GitHub Appを使って GitHub APIを叩く (個人のPATではなく)

https://qiita.com/nakamasato/items/88b1ccc9e3f40953ffb5

# GitHub AppをGitHub Actionsで使う

Tokenを得るためには以下のStepで可能

https://github.com/actions/create-github-app-token

create-github-app-tokenを使ってTokenを取得する。あらかじめ`APP_ID`と`PRIVATE_KEY`をRepository Secretsなどに格納しておく必要がある

```yaml
      - name: create-github-app-token
        if: steps.date_check.outputs.updated == 'true'
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.GH_TEST_APP_ID }}
          private-key: ${{ secrets.GH_TEST_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
```


# Ref

- https://zenn.dev/tatsuo48/articles/72c8939bbc6329
- https://zenn.dev/tmknom/articles/github-apps-token
- https://note.com/teitei_tk/n/n5ad51f00a006
- https://dev.classmethod.jp/articles/register-github-app-and-get-access-token/
- App examples
    - [Building a GitHub App that responds to webhook events](https://docs.github.com/en/apps/creating-github-apps/guides/building-a-github-app-that-responds-to-webhook-events)
    - [CLI with Github App](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/building-a-cli-with-a-github-app)