Crate secrets_engine_github 

GitHub App installation tokens — the one provider in this set where a lease means exactly what it says: credentials are short-lived by construction, narrowable to named repositories and a subset of permissions, and genuinely revocable before expiry.

See docs/delegation/github.md for the mechanism and docs/delegation/setup/github.md for the operator walkthrough.

Structs

GithubConfig

The App’s identity. private_key_pem is the only durable secret this engine needs, and it is never read back out (see ConfigRoleStore).

GithubEngine

RoleConfig

What one consumer may mint. Both repositories and permissions narrow the token down from what the installation was granted — they can never widen it, so the App’s own permissions remain the ceiling.