e11community/Repo Reacher

Authorize git to clone private repositories across one or more orgs using a GitHub App, then rewrite global git config so subsequent steps (e.g. terraform init) authenticate transparently.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
friends	Newline-delimited owners to authorize. Each line is either a bare `owner` (token scoped to every repo the App is installed on under that owner) or `owner/repo` (token scoped to that repo; repeat lines to add more repos under the same owner). A bare `owner` line supersedes any `owner/repo` lines for the same owner.	yes	—
app_id_env	Name of the environment variable holding the GitHub App ID. The App ID is not a secret; map it in your workflow from a repository variable, e.g. set env `REPO_REACHER_APP_ID` to the `REPO_REACHER_APP_ID` repo variable. Override only if the conventional name collides.	no	REPO_REACHER_APP_ID
private_key_env	Name of the environment variable holding the GitHub App private key (PEM, raw or base64). Map it from a secret in your workflow, e.g. set env `REPO_REACHER_KEY` to the `REPO_REACHER_KEY` secret. Override only if the conventional name collides.	no	REPO_REACHER_KEY
permissions	Comma- or newline-delimited `name:level` pairs that narrow the minted token to a SUBSET of what the App was granted (you cannot escalate beyond the App's permissions). Level is `read`, `write`, or `admin`. Defaults to `contents:read` — the least privilege needed to clone — so a token from this action stays read-only even if an org admin later grants the App write. Set to `inherit` to use the App installation's full grant instead.	no	contents:read

Outputs

name	description
token	The minted GitHub App installation access token (masked in logs, short-lived ~1h). Git is already configured to use it transparently, so this is only needed to chain auth into steps the git rewrite doesn't cover — non-git steps (the `gh` CLI, GitHub API calls) and `actions/checkout`, which manages its own credentials. When authorizing a single owner (the typical case) this is that owner's token; with multiple owners it is the FIRST owner's token — see `tokens_json` to pick a specific one.
tokens_json	JSON object mapping each authorized owner to its minted token (each masked in logs). Use this when authorizing multiple owners and you need a specific one in a later step: `${{ fromJSON(steps.<id>.outputs.tokens_json)['<owner>'] }}`.

name

description

token

The minted GitHub App installation access token (masked in logs, short-lived ~1h). Git is already configured to use it transparently, so this is only needed to chain auth into steps the git rewrite doesn't cover — non-git steps (the `gh` CLI, GitHub API calls) and `actions/checkout`, which manages its own credentials. When authorizing a single owner (the typical case) this is that owner's token; with multiple owners it is the FIRST owner's token — see `tokens_json` to pick a specific one.

tokens_json

JSON object mapping each authorized owner to its minted token (each masked in logs). Use this when authorizing multiple owners and you need a specific one in a later step: `${{ fromJSON(steps.<id>.outputs.tokens_json)['<owner>'] }}`.