GitHub App token is repo scoped

[jaroslawgajewski]

#Problem

The compiler adds repositories: ${{ github.event.repository.name }} which limits the GitHub App token to only the triggering repo. Cross-repo workflows need org-wide access (all repos the app is installed on)

Expected solution

Allow to flag workflows that can use Org level scope

[pelikhan]

/scout research how this can be configured. Specifically by using repositories: ["*"]. Link to docs.

[github-actions]

🔍 Scout Research Report

Triggered by @pelikhan

Executive Summary

The repositories: ["*"] wildcard is the supported way in gh-aw to grant org-wide GitHub App token access. The auth documentation explicitly covers three scoping modes for the github-app: configuration.

Click to expand detailed findings

Research Findings

How repositories Scoping Works in gh-aw

From the Authorization reference docs, the github-app: configuration supports three modes:

Configuration	Scope
Omit repositories field	Current repository only (default)
repositories: ["*"]	Org-wide access (all repos in the installation)
repositories: ["repo1", "repo2"]	Specific repositories only

Configuration Example — Tools Authentication

tools:
  github:
    mode: remote
    toolsets: [repos, issues, pull_requests]
    github-app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      owner: "my-org"         # Optional: defaults to current repo owner
      repositories: ["*"]     # Org-wide access

Configuration Example — Safe Outputs Authentication

safe-outputs:
  github-app:
    app-id: ${{ vars.APP_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
    owner: "my-org"
    repositories: ["*"]       # Org-wide access
  create-issue:

How This Maps to actions/create-github-app-token

Under the hood, gh-aw uses actions/create-github-app-token. From that action's docs:

If owner is set and repositories is empty, access will be scoped to all repositories in the provided repository owner's installation.

The repositories: ["*"] syntax in gh-aw frontmatter translates to leaving the repositories input empty on the underlying action (passing just owner), which achieves org-wide scope.

Recommendations

1. Add repositories: ["*"] under the github-app: block in your workflow's tools.github.github-app or safe-outputs.github-app section.
2. Make sure to also set owner: ${{ github.repository_owner }} (or your org name) — without owner, the token defaults to the current repo owner but the repositories: ["*"] wildcard still needs the owner context.
3. Ensure the GitHub App is installed at the organization level (not just on individual repos), otherwise org-wide scoping will fail.

Key Sources

• gh-aw Authorization Reference — official docs covering all scoping modes
• actions/create-github-app-token Marketplace — underlying action docs
• GitHub Docs: Making authenticated API requests with a GitHub App
• gh-aw Multi-Repository Examples

Suggested Next Steps

1. Update the workflow frontmatter to add repositories: ["*"] and owner: to the github-app: block.
2. Re-compile with gh aw compile to regenerate the .lock.yml.
3. Verify the GitHub App installation covers all target repositories at the org level.

References:

• gh-aw Authorization Docs
• Workflow Run §22724690719

🔭 Intelligence gathered by Scout · ◷

[pelikhan]

@jaroslawgajewski does this work for you?

[jaroslawgajewski]

Yep
As workaround im using different shared definitions depending on scope

[pelikhan]

@copilot add FAQ entry on this question.

Use technical-doc-writer agent.