Repository navigation
fix: accept GitHub's stateless installation tokens in the upload service - #117
Merged
Merged
Conversation
GitHub now issues App installation tokens as ghs_<app id>_<JWT> (about 520 characters, with . and -). The service checked minted tokens against the 40-character user-token pattern, so every upload failed with github_unavailable. Use GitHub's published installation-token pattern. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The first live deployment of the upload service refused every upload with
github_unavailable. The Vercel log showedminting the installation token failed: GitHub failed, HTTP 201, so GitHub had minted the token, butinstallationTokenrejected it.Since April 2026 GitHub issues App installation tokens in a stateless form,
ghs_<app id>_<JWT>. These are about 520 characters long and contain.and-(notice). The service checked minted tokens against the user-token pattern^[A-Za-z0-9_]{20,512}$, which rejects them.Change
INSTALLATION_TOKEN_PATTERN = /^ghs_[A-Za-z0-9._-]{36,}$/, GitHub's published pattern, used only for the minted installation token.TOKEN_PATTERNis unchanged for submitters' sign-in (user-to-server) tokens. The format change covers server-to-server tokens only.INSTALL_TOKENis now the long form, and a new test accepts both forms and rejects whitespace, newlines, short tokens and non-ghs_tokens.Evidence
node --test "services/uploads/test/*.test.mjs" test/scripts/upload_refs_parity.test.mjs: 47/47 pass. With the oldgithub.mjsand the new tests, 21 fail.eslint services/uploadsis clean, and prettier is clean.🤖 Generated with Claude Code