actions/create-github-app-token warning

[straub]

Hey there!

Just a heads-up, I get

Warning: Unexpected input(s) 'permission-discussions', valid inputs are ['app-id', 'private-key', 'owner', 'repositories', 'skip-token-revoke', 'github-api-url', 'permission-actions', 'permission-administration', 'permission-checks', 'permission-codespaces', 'permission-contents', 'permission-custom-properties-for-organizations', 'permission-dependabot-secrets', 'permission-deployments', 'permission-email-addresses', 'permission-enterprise-custom-properties-for-organizations', 'permission-environments', 'permission-followers', 'permission-git-ssh-keys', 'permission-gpg-keys', 'permission-interaction-limits', 'permission-issues', 'permission-members', 'permission-metadata', 'permission-organization-administration', 'permission-organization-announcement-banners', 'permission-organization-copilot-seat-management', 'permission-organization-custom-org-roles', 'permission-organization-custom-properties', 'permission-organization-custom-roles', 'permission-organization-events', 'permission-organization-hooks', 'permission-organization-packages', 'permission-organization-personal-access-token-requests', 'permission-organization-personal-access-tokens', 'permission-organization-plan', 'permission-organization-projects', 'permission-organization-secrets', 'permission-organization-self-hosted-runners', 'permission-organization-user-blocking', 'permission-packages', 'permission-pages', 'permission-profile', 'permission-pull-requests', 'permission-repository-custom-properties', 'permission-repository-hooks', 'permission-repository-projects', 'permission-secret-scanning-alerts', 'permission-secrets', 'permission-security-events', 'permission-single-file', 'permission-starring', 'permission-statuses', 'permission-team-discussions', 'permission-vulnerability-alerts', 'permission-workflows']

from the "Generate GitHub App token" actions/create-github-app-token step when using

safe-outputs:
  create-discussion:
    max: 1
    ...

along with

tools:
  github:
    toolsets: [default]
    app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      ...

Perhaps unrelated, it also appears that max: 1 is not working with create-discussion, as I have multiple open discussions from different workflow runs.

I'm currently on gh-aw v0.50.5 and actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf.

Thanks!

[pelikhan]

/scout investigate if the permission is already file against the action repo . It is a bug in their side.

[github-actions]

🔍 Scout Research Report

Triggered by @pelikhan

Executive Summary

The bug has already been filed against actions/create-github-app-token as issue #307 — filed by @pelikhan on 2025-11-21. However, the maintainer's response and subsequent clarification reveal this is not a bug in actions/create-github-app-token. The root cause is in gh-aw's own code.

Click to expand detailed findings

Research Findings

Issue #307 in actions/create-github-app-token

• Filed by: @pelikhan (2025-11-21)
• Status: Open
• Maintainer response (@parkerbxyz): discussions is not listed in the GitHub REST API for installation access tokens, even though it is an option in GitHub App settings. The action's valid inputs are auto-generated from the REST API spec.
• pelikhan's follow-up: "Indeed I was confusing App permissions with Action permissions..."

Why permission-discussions is Invalid

The GitHub REST API endpoint for creating installation tokens (POST /app/installations/{installation_id}/access_tokens) does not support discussions as a permission scope. The discussions permission only exists at the GitHub App configuration level — it cannot be used to scope individual installation tokens. This is a GitHub API limitation, not an action bug.

The Real Bug Location

The warning is triggered because safe_outputs_app.go (line 235–237) maps PermissionDiscussions to permission-discussions and passes it to actions/create-github-app-token:

if level, ok := permissions.Get(PermissionDiscussions); ok {
    fields["permission-discussions"] = string(level)
}

This input is rejected by the action with Warning: Unexpected input(s) 'permission-discussions', since that input was never defined in the action's action.yml.

There is also a test in safe_outputs_app_test.go (line 152–153) asserting this behavior, which means the test itself is validating incorrect behavior.

Also of Note

Issue #310 was filed shortly after, reporting a similar missing permission: permission-attestations. This points to a broader gap between gh-aw's permission model and what the action actually supports.

Recommendations

1. Remove the permission-discussions → permission-discussions mapping in safe_outputs_app.go. Move PermissionDiscussions to the "no GitHub App equivalent" note (alongside models, id-token, attestations).
2. Update the test in safe_outputs_app_test.go that asserts permission-discussions: write should be present — that assertion is incorrect.
3. Clarify behavior for create-discussion: When using a GitHub App token, discussions permission is granted at the app-installation level (not token level), so the token will work as long as the GitHub App has been granted Discussions write access in its settings.

Key Sources

• actions/create-github-app-token issue #307 — the exact bug report
• gh-aw pkg/workflow/safe_outputs_app.go:235–237 — where the invalid input is generated

References: §22531177735

🔭 Intelligence gathered by Scout