Add repository created by Github App to Github App repository access

[stefandarius]

Hi! I want to develop a GitHub App that can create a repository from a specified template and then performing some actions on that repository (e.g. a adding secrets, workflows).

I am facing the following problem. Suppose a user that installs and authorizes my app decides to not give permission for all repositories, and chooses just some repositories from their account. In that case, my app will successfully create a new repository from the specified template using an user access token. Still, it will fail to further modify the repository (commit a file update) because it is not in the repository access list of the GitHub App.

What I want to achieve is to automatically add repositories created by the GitHub App to the repository permission list of that app. I found an API endpoint for adding a repo to an installation (PUT /user/installations/{installation_id}/repositories/{repository_id}), but this requires a Personal Access Token. I want to perform this action using the GitHub App with any form of authentication (as a user or as an installation).

Upon researching this issue, I found the Vercel Github App, that successfully does exactly what I described, but I can't figure out how they do this. I looked at permissions requested by their app and mine I think I have all the necessary permissions for this task.

Vercel requested permissions

Read access to metadata
Read and write access to administration, checks, code, commit statuses, deployments, issues, pull requests, and repository hooks

My App's requested permissions

Read access to actions and metadata
Read and write access to administration, code, secrets, and workflows 

I would really appreciate any advice regarding this. Thank you!

[kprkacin]

Any resolutions on this?

[stefandarius]

I found a solution. Apparently, if you create a blank repository using a GitHub App, that repository is automatically added to the app's permissions list. I was trying to create a repository using a template, and it looks like this endpoint doesn't add the newly created repo to the app permission list.

The solution was to create a blank repository in order to be accessible by the app. After that, I was able to use the GitHub API to make changes to that repository. However, because I wanted to initialize the repository with a template, I couldn't make use of the API, so I had to programmatically clone the repository and push my template as an initial commit.

[kprkacin]

Thank you very much, could you also point me to the endpoint for creating an empty repo? From what I can see my only options are Create an organization repository which is a problem when its only for a user, and Create a repository for the authenticated user which doesn't support GitHub apps?

[stefandarius]

You can use the second endpoint you mentioned. This is the one I used. You can pass a User Access Token and it works just fine.
Unless an endpoint explicitly mentions you have to use a Personal Access Token or Basic Auth, it will most probably work with Github Apps using a User Access Token.

[kprkacin]

Yeah you're right, thanks! Seems a bit weird that it works that way, and Create a repository using a template doesn't.

[stefandarius]

Very weird indeed.
Glad I could help!

[jonathanhar]

Still running into this today, even when creating an empty repo (with PyGithub). Any ideas?