IMO, the right way is for GitHub to allow for JWT/OIDC federation, ideally allowing custom public keys to be uploaded, so I can issue my own tokens from a secure crypto source. With the GitHub app, you're still copying/pasting long lived tokens during the setup phase.