Does the action supports different API endpoint for GitHub enterprise?

[ricardojdsilva87]

Hello everyone I just have a question regarding the evergreen action.
During my tests it seems that the action works well with the GH_TOKEN but not with the GitHub App credentials. The issue seems to be on the API usage for an Enterprise URL endpoint.
With the GH_TOKEN the API endpoint is correct, adding the /api/v3 to the provided GH_ENTERPRISE_URL.

Using the secrets for the created GitHub App and running it locally with DEBUG logs I get the following result:

INFO:github3:Building a url from ('https://api.github.com', 'app', 'installations', '1234', 'access_tokens')
INFO:github3:Missed the cache building the url
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.github.com:443
DEBUG:urllib3.connectionpool:https://api.github.com:443 "POST /app/installations/1234/access_tokens HTTP/11" 404 None
Traceback (most recent call last):
  File "/Users/silvaric/projects/GIT/evergreen/./evergreen.py", line 414, in <module>
    main()  # pragma: no cover
    ~~~~^^
  File "/Users/silvaric/projects/GIT/evergreen/./evergreen.py", line 51, in main
    github_connection = auth.auth_to_github(token, gh_app_id, gh_app_installation_id, gh_app_private_key, ghe)
  File "/Users/silvaric/projects/GIT/evergreen/auth.py", line 32, in auth_to_github
    gh.login_as_app_installation(gh_app_private_key_bytes, gh_app_id, gh_app_installation_id)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/lib/python3.13/site-packages/github3/github.py", line 1527, in login_as_app_installation
    json = self._json(response, 201)
  File "/opt/homebrew/lib/python3.13/site-packages/github3/models.py", line 161, in _json
    raise exceptions.error_for(response)
github3.exceptions.NotFoundError: 404 Integration not found

It seems that using a GitHub App as authentication, the endpoint used is still the one for github.com, thus failing the authentication since the installed app does not exist in github.com.

Not sure if I'm doing something wrong or missing some setting?
Thank you for the help

[ricardojdsilva87]

Hello again, did some testing and was able to put to work a configuration on an action using a GH App + GitHub Enterprise server

name: Evergreen
on:
  workflow_dispatch:
  schedule:
    - cron: "3 2 * * 6"

permissions:
  contents: read

jobs:
  evergreen:
    name: "Create dependabot.yml"
    runs-on: <label>

    steps:
      - name: Get GitHub app token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: 1234
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: <owner>

      - name: Run evergreen action
        uses: github/evergreen@v1
        env:
          GH_ENTERPRISE_URL: ${{ github.server_url }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          ORGANIZATION: <ORG>
          UPDATE_EXISTING: True
          GROUP_DEPENDENCIES: True

The needed permissions for the app are the following:
NOTE: Most likely there are more permissions needed to enable the security updates, we have by default that enabled for every repository so it is not needed for evergreen to enable that

Not sure if this information should be added as an example on the README? I can gladly open the PR for that.
Related to the GH App usage I believe that the way to use it with the mentioned env variables is missing something on the action itself to use the correct GitHub enterprise endpoint.
Thanks

[zkoppert]

We are open to pull requests so please feel free. I believe that the enterprise endpoint issue is likely the same issue as here: github/issue-metrics#364

[ricardojdsilva87]

Hello @zkoppert,
I've opened the following Pull Request
#256

Tested it locally on my computer agains a GHE server and it works correctly, also enabling the Dependabot security updates.
Just need to complete the documentation now with some examples

[jmeridth]

This is a recent feature enhancement where enterprises can now create GitHub Apps just for their enterprise.

Thank you for pointing out we need to re-address the GitHub App authentication url. I'm reviewing your PR now.