ksuderman

GitHub App Token Setup for Galaxy Helm Chart Updates

This document explains how to create a GitHub App token for the workflow that automatically creates PRs to update the Galaxy Helm chart when new Galaxy releases are tagged.

Why Use GitHub App Tokens?

GitHub App tokens are more secure than Personal Access Tokens (PATs) because they provide:

• Better Security: Scoped permissions, automatic token rotation
• Better Audit Trail: Actions appear as performed by the app
• No User Dependencies: Doesn't depend on individual user accounts

ksuderman

Creating the release GitHub App

The release workflow uses a GitHub App (rather than the default GITHUB_TOKEN) because it must bypass branch protection to push the version-bump commit and tag to master, publish to another repository, and trigger a downstream repo. The default GITHUB_TOKEN cannot do these things.

1. Create the App. Go to the organization's Settings → Developer settings → GitHub Apps → New GitHub App (an org-owned App is recommended over a personal one so ownership survives