Is it possible to use GitHub app for authentication instead of PAT for pipeline auto pr?

[setaskin]

Output of brew config

N/A

Output of brew doctor

N/A

Description of issue

We use PAT in pipeline for authentication to send an auto PR every time we release. Does Homebrew support one of these authentication methods? https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app#about-authentication-as-a-github-app

Relevant casks

Casks/d/devtunnel.rb

[Bo98]

You are able to use an installation access token (e.g. via https://github.com/actions/create-github-app-token) and pass that to Homebrew: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation#authenticating-with-an-installation-access-token.

Note however that GitHub apps are restricted to particular repositories they are installed to so you'll only be able to push to repositories where that GitHub app is installed to (including forks) and you can't open PRs to e.g. Homebrew repositories where the app isn't installed. That isn't Homebrew-specific, so the GitHub documentation will have more information on how the GitHub App security model differs to PATs.

[setaskin]

@Bo98 , thank you for the response. This is so helpful. One follow up question would be, is there a specific reason you suggested installation access token? I was thinking to use github token. Not sure which one is more appropriate for us.
so to summarize our case: we don't want to use PAT in our pipelines. Our code base is not on GitHub and we are looking for alternative authentication methods when we send auto pr from our release pipeline with brew bump-cask-pr

[SMillerDev]

Homebrew just uses the GitHub API underneath so it supports whatever GitHub supports. I believe whatever you set as GITHUB_TOKEN will work for Homebrew

[Goooler]

This has been finished in Homebrew/brew#18242. It works like https://github.com/Goooler/homebrew-repo/blob/4aa63902ae79448b75cb26f556281a6fc2eca06c/.github/workflows/autobump.yml#L17-L27.

NOTE:

permissions:
  contents: write

Doesn't work for me, I changed it to permissions: write-all.