From a2a8474b4f21c3ca24a8507eba3f1f3e4d448ce2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 10:55:55 +0000 Subject: [PATCH] [docs] Update glossary - daily scan Add GitHub App Repositories (github-app.repositories) term introduced in commit 53ee20834 (Honor `repositories: ["*"]` in activation GitHub App token minting, #45908). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/src/content/docs/reference/glossary.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/src/content/docs/reference/glossary.md b/docs/src/content/docs/reference/glossary.md index a90c88fbea8..3ae64c6dfa8 100644 --- a/docs/src/content/docs/reference/glossary.md +++ b/docs/src/content/docs/reference/glossary.md @@ -113,6 +113,18 @@ safe-outputs: create-issue: ``` +### GitHub App Repositories (`github-app.repositories`) + +A `safe-outputs.github-app` field that controls which repositories are included in the GitHub App installation token scope. Accepts `["*"]` to request an installation token without an explicit repository restriction (granting access to all repositories the App installation covers), or an array of explicit repository names to request a narrowly-scoped token. When `["*"]` is specified, implementations omit the `repositories` parameter from the token-minting API call — they do not substitute the triggering repository name. This behavior applies to both the activation-job token and subsequent safe-output-job tokens, including `workflow_call` reusable-workflow scenarios where the agent configuration may live in the callee repository. When the field is omitted, implementations default to the triggering repository as the token scope. See [Safe Outputs Specification](/gh-aw/specs/safe-outputs-specification/). + +```aw wrap +safe-outputs: + github-app: + client-id: ${{ vars.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + repositories: ["*"] +``` + ## Security and Outputs ### MCP Scripts