How to Check Out Another Private Repo With a GitHub App Token

GITHUB_TOKEN cannot read a different private repo, so mint an App token scoped to include it and pass that to checkout.

Scope the installation token to the extra repositories with the repositories input, then pass the token to a second actions/checkout step targeting that repo.

Steps

• Install the App on both repos.
• Set repositories: on create-github-app-token to include the private repo.
• Pass the token to actions/checkout with repository: set to the other repo.

Workflow

steps:
  - uses: actions/create-github-app-token@v1
    id: app-token
    with:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      owner: my-org
      repositories: shared-libs
  - uses: actions/checkout@v4
    with:
      repository: my-org/shared-libs
      token: ${{ steps.app-token.outputs.token }}
      path: shared-libs

Gotchas

• The App needs contents: read permission on the other repo.
• Use distinct path: values so the two checkouts do not overwrite each other.

Related guides