Working across organizations with Github apps

[danielrenaud]

In my understanding; a Github app can be installed in multiple orgs, but it is only possible to be authenticated with a single org at a time. With a script or application you can work with multiple orgs be re-authing.

However, given my understanding of authentication is correct, is it possible to perform an action that requires authentication with multiple orgs at the same time. From the situation I’m encountering (described below) it would seem that it is not.

I have two organizations; org1 and org2. In each org there is a private repo; repo1. org2:repo1 is forked from org1:repo1.

I want to create a PR for org2:repo1 -> org1:repo1. The app is authenticated with org1.

I always recieve a “422: not all refs are readable” error when trying to create the PR. The app is installed on both orgs and I’ve checked that I can make a PR inside each org.

It seems like the app needs to read from org2, but since the repo is private and the app is not authenticated with that org, it is not able to read the repo and I get this error.

Is this a known limitation or is there some way to work around this?

Does it matter if org2 is an actual organization or a personal user account?

Thanks

[lee-dohm]

Have you granted “Repository contents” permission (both read and write) to the GitHub app? In order to create a PR, it needs to be able to check that the refs that the PR is created from exist. In order to do that, it needs to be able to inspect the repository contents.

Let us know if that helps!

[lee-dohm]

We’ve double-checked this with the team working on GitHub Apps and – you’re right. For the case that you described (making a pull request between a private fork and parent) will not work if you’re doing it as a GitHub App. The reason is as you guessed – a single installation has access to repositories only from a specific user or organization, and a pull request between a private fork and parent requires access from two organizations. I’ve opened an internal issue to see if there is a way to support this after all, but even if that’s possible – I’m guessing it won’t happen very quickly since permissions are never a trivial thing to implement.

Other cases (pull requests between public fork and parent, and pull requests within a single private repository) should still work.

Apologies for the spurious question!

[linker34]

It seems that this is still an issue, we have the use case where the GitHub Application that we created requires to be installed on multiple organizations to manage the GHA Runners of them and it doesn't work. Hopefully this will be considered soon.

[PhoenixHe-NV]

Hi @lee-dohm is this issue resolved or in progress? We still get this error while making PR across private fork.

[ionutzaharia]

It seems that this is still an issue, we have the use case where the GitHub Application that we created requires to be installed on multiple organizations to manage the GHA Runners of them and it doesn't work. Hopefully this will be considered soon.

[MikeJerred]

This is still an issue 4 years later.

[Jaegin]

Hi @lee-dohm - is this being actively worked on? And, if so, when can a fix be expected by?

[roulettedares]

We need the ability to install a Github App on an entire enterprise instead of at the organization level.

[mithunkrb]

We need the ability to install a Github App on an entire enterprise instead of at the organization level.

Hi Team, we are also requiring this ability to install a Github App on multiple orgs without making it public app. Do we have any PR or issue tracking this? If yes, could you please share?

[hpsin]

👋 This shipped to GA in March, sorry I missed this comment. You can have an internal app for your enterprise that is just accessible to your enterprise's orgs.
https://github.blog/changelog/2025-03-10-enterprise-owned-github-apps-are-now-generally-available/

[dserodio]

I read this post and it mentions:

However, Enterprise Classic organizations and standard user accounts can only transfer private Apps, as internal Apps are not supported in Enterprise Classic.

This is the first time I hear about "Enterprise Classic", and a Google search for github "enterprise classic" is not helpful. What is Enterprise Classic and how can I find out if my Enterprise is "Classic" or not?

[hpsin]

Ah, sorry! It's a term for non-EMU enterprises, i.e, where you use your personal account to work within the enterprise, as opposed to EMU enterprises. I'll see about making sure that has a hit in the docs.

[dany74q]

Same here, are enterprise-scoped apps / tokens on the roadmap ?
It would be extremely useful for integrations in large enterprises.

[Harry654]

Hi, please has the issue of creating a PR across forks been resolved?

[jluque0101]

Hi friends, is there any update on this?

[kaovilai]

I want a GitHub App to "impersonate" and use my identity to comment or review.a PR as me.. as good as PAT.

[Cavaler]

Same feature is required if you want to create a repo on one organization from a template in a different one.
Looking forward to see it implemented, though after 6 years not that much hope...

[ad-zsolt-imre]

We are facing the same issue. Would need to be able to share GH app across multiple orgs.

[jasontempleman-eaton]

Same here. Any update on this?

[xmo-odoo]

FWIW if an application is authorized via a user account, and installed in multiple organizations, the application can create user access tokens (as opposed to installation access tokens) and interact with multiple organizations at the same time.

This does mean the application will be identified as the user (rather than the application), and requires the user account to have access to the repositories with a sufficient level of access, but it does allow using the much finer grained access of github apps (including IP range allow lists etc...)