How to Open Cross-Repo Dependency Update PRs With a GitHub App

One App installed on many repos can push branches and open PRs in each, which GITHUB_TOKEN cannot do.

To bump a shared dependency across repos, mint an App token scoped to those repos, check each out, commit the bump, and open a PR. The App identity keeps the automation independent of any person.

Steps

• Install the App on every target repo with contents and pull-requests write.
• Loop over repos, checking each out with the App token.
• Push a branch and open a PR with gh pr create.

Workflow

steps:
  - uses: actions/create-github-app-token@v1
    id: app-token
    with:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      owner: my-org
  - env:
      GH_TOKEN: ${{ steps.app-token.outputs.token }}
    run: |
      for repo in api web worker; do
        gh repo clone my-org/$repo -- --depth 1
        (cd $repo && ./bump-dep.sh && \
          git switch -c bump-dep && git commit -am "chore: bump dep" && \
          git push -u origin bump-dep && \
          gh pr create --fill --repo my-org/$repo)
      done

Gotchas

• Scope the token to only the repos you update, not the whole org, when you can.
• Rate-limit the loop for large fleets to avoid secondary limits.

Related guides