GitHub App token instead Personal Access Token (PAT)

[mu88]

Summary:
I’d like to use a GitHub App token instead of a Personal Access Token (PAT) when running lowlighter/metrics.
The goal is to avoid relying on a long-lived PAT and instead use the more secure, short-lived tokens generated by a GitHub App installation.

❓ Question

Is it possible to authenticate lowlighter/metrics using a GitHub App token?
If so, how should the GitHub App be configured (permissions, installation setup, etc.) to work correctly with the Metrics action?

I’m mainly trying to understand which permissions/scopes the GitHub App needs.

So far, I created a GitHub App with the following permissions:

• Repository permissions
  • Contents: Read-only
  • Metadata: Read-only
  • Packages: Read-only
  • Projects: Read-only
• Account permissions
  • Followers: Read-only
  • Gists: Read and write
  • Profile: Read and write
  • Starring: Read-only
  • Watching: Read-only

Here you can see how I integrated it into my workflow, and here you can find the results. As you can see, several information are gone, e.g. packages or other public repos.

🧩 Context

Right now, the docs mostly describe using a Personal Access Token with repo and read:user scopes.
However, GitHub App tokens are more secure and automatically rotated, which would make setup and maintenance easier.

Would love some guidance (or examples) if this is supported - or confirmation if it isn’t currently possible.

Thanks for your work on this project!