This action could handle a little more flexibility in the repositories input. A common mistake is to provide repositories: foo, bar instead of repositories: foo,bar if a token is needed for > 1 repository.

For example:

    - name: Generate Github Actions App token
      id: generate-token
      uses: actions/create-github-app-token@v1
      with:
        app-id: ${{ env.GH_APP_APP_ID }}
        private-key: ${{ env.GH_APP_PRIVATE_KEY }}
        repositories: foo, bar

Fails to get a token because the body in the HTTP request to GH will look like this:

body: '{"repositories":["foo"," bar"]}',

I think trimming the repos, something like repos = repos.map(r => r.trim()), would catch this and make for a more intuitive API