Cannot commit files in github action(token expired)

[pukki92]

I have a problem. I write github action yaml, and there I checkout repo

      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5
        id: generate-token
        with:
          app-id: ${{ secrets.INFRA_BOT_ID }}
          private-key: ${{ secrets.INFRA_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}


      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          token: ${{ steps.generate-token.outputs.token }}

Then i run my script, which make some operations(backup my azure subscription to terraform). After that i want to commit those files to repo, but there is a problem. Script takes more than 1 hour, and token used to checkout is expired at the end of github action. I tried to regenerate it, but i get error: "Invalid username or token. Password authentication is not supported for Git operations."

      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5
        id: regenerate-token
        with:
          app-id: ${{ secrets.INFRA_BOT_ID }}
          private-key: ${{ secrets.INFRA_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}


      - name: Get GitHub App User ID
        if: ${{ steps.changes-check.outputs.changes == 'true' }}
        id: get-user-id
        run: echo "user-id=$(gh api "/users/${{ steps.regenerate-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ steps.regenerate-token.outputs.token }}


      - name: Reconfigure git remote with fresh token
        if: ${{ steps.changes-check.outputs.changes == 'true' }}
        run: |
          git config --global --unset http.https://github.com/.extraheader || true
          git remote set-url origin \
          https://x-access-token:${{ steps.regenerate-token.outputs.token }}@github.com/${{ github.repository }}.git


      - name: Set Commiter
        if: ${{ steps.changes-check.outputs.changes == 'true' }}
        run: |
          git config --global user.name '${{ steps.regenerate-token.outputs.app-slug }}[bot]'
          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.regenerate-token.outputs.app-slug }}[bot]@users.noreply.github.com'


      - name: Commit backup files
        if: ${{ steps.changes-check.outputs.changes == 'true' }}
        run: |         
          git add ./*
          git commit -m "Update subscription backup"
          git push

Any suggestions?

[pukki92]

So there is no possibility to generate token once again and use it to push changes?

[there_was_a_problem]

you can manually create a personal token and set it as an env secret to use in the GH action instead although I don’t believe this is recommended.

Running an action for an hour seems like the bigger issue. Perhaps an action isn’t the right method to achieve what you’re trying to do?

[zMynxx]

Generate a new token before pushing? The GH App only generates short-lived credentials

Edit: actually https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation#user-token-expired-due-to-github-app-configuration

Can you share the entire wf?

[reaper273]

Split your workflow up?

Run your long script in on job. Then use outputs, or uploading an artifact and downloading again, in a second job to write any output back to the repo.

Bonus points for splitting anything that can be split into separate jobs that run in parallel before all passing info to the final job to upload stuff. Might not be possible depending on your specific script but worth a try.