github-token-anchor

Intentionally empty. This repository holds no code and is not meant to.

It exists as a scope anchor for GitHub App installation tokens. Several CI workflows — currently in bbi-dev-controlling/devtools on GitHub Enterprise — need a token that is valid on github.com, because their own secrets.GITHUB_TOKEN is a GHE token and is rejected there. Those tokens are used purely to lift the anonymous api.github.com rate limit (60 requests/hour) while downloading public release artifacts (bats, trivy) or querying public repositories (zizmor's online audits).

Any authenticated token lifts that limit, no matter what it can reach. But actions/create-github-app-token needs a repositories: value, and omitting it — or omitting permission-<name>: — mints a token with blanket access to every repository of the installation, which zizmor's github-app audit flags as dangerous. Naming a real, unrelated repository would work too, but couples those workflows to a repository that might get renamed, archived or transferred.

Hence this one. The workflows request the smallest scope possible:

- uses: actions/create-github-app-token@<sha>
  with:
    github-api-url: https://api.github.com
    client-id: ${{ secrets.PUBLIC_APP_CLIENT_ID }}
    private-key: ${{ secrets.PUBLIC_APP_PRIVATE_KEY }}
    owner: brainbits
    repositories: github-token-anchor
    permission-metadata: read

Nothing ever reads from or writes to this repository — metadata: read is the weakest permission GitHub offers, and the token is only ever pointed at public resources elsewhere.

Please do not delete or rename it. Doing so breaks token minting in every workflow that references it.