Installing a private Github App to an enterprise account

[gnsantos]

Hello all,

I am currently working on an application within my company that relies on Github integration, more specifically, we need to programatically clone a repository on a remote machine.

We’ve choosen to do this integration using Github Apps. The idea was to create a Githu App in the enterprise account, create a private key for it, install the app in the enterprise’s account and them use Private Key, App Id and the Installation Id created to get an access token. The token would then be used to clone the repo.

The problem is that after creating the app, we were not able to install it to the enterprise account, we were only given the option of installing the app to our personoal accounts. This way, the app would not have read access to the necessary repos and we could not use an access token acquired by it to clone the repo.

When I looked for ways of installin apps to enterprise accounts, the only solution I came across was this: https://help.github.com/en/articles/installing-an-app-in-your-organization

But by this guide we would need to have our app in the Github Market place, which does not seem like the right thing, since it has no reason for being there.

TL;DR: Is there a way to install a private app (owned by an enterprise) to the enterprise’s account? Is there other ways to grant the Github app read-acces to the enterprises repos?

[lee-dohm]

Are you using GitHub Enterprise Server? Or Enterprise Cloud?

If you’re using Enterprise Server, you may need to be a GitHub App manager or organization owner in order to manage GitHub Apps for that organization in your Enterprise Server instance.

If you’re using Enterprise Cloud and you’re an organization owner, then you should be able to follow the standard instructions for creating a GitHub App.

In any case, it sounds like you may not have the right level of access to install the app you’ve built into the organization?

Let us know if you have more information or questions.

[mikeparker]

I’m running up against the same problem. I am a developer without admin rights but I’ve built an app and want to request my organisation to install it without making it public. Is this possible? I can’t see the ‘make internal’ button anywhere and I can’t see how to tie the app to an organisation i’m in.

[mikeparker]

Ok just figured out how to do this.

First you donate the app to the organisation. ‘Transfer Ownership’

Then you get an admin to install the app on whichever repos you need.

[bwalding]

We faced a similar issue - there is no concept of a private GitHub app that can be shared across all orgs in an enterprise. We raised with our account manager and they said it had been raised with them frequently (but no promises on a fix).

Our solution was to add an installation hook in the app that deinstalls the app.

So if someone discovers our marketplace app and installs it, we uninstall it a few seconds later. There's no security risk from our side - as we just don't offer any features outside of our enterprise - but it keeps things clean (and saves us from receiving a bunch of webhooks we will have to ignore).

[equalizer999]

Hi @bwalding, not sure if you have seen this: https://github.blog/changelog/2024-10-22-enterprises-can-create-github-apps-for-use-within-the-enterprise/. But it sounds like this solves the use-case you are describing here.

[ramnarayanank]

You can’t directly install a GitHub App at the enterprise account level; it must be installed on organizations within the enterprise. For private repos, create the app under the enterprise-owned org, then install it there to grant repo access. No marketplace listing is needed. Ensure the app has proper repo permissions and use its installation token for cloning. This aligns with best practices in enterprise app development services (as followed by teams like CONTUS Tech).