Repository navigation
Authenticate API GitHub reads with the Integrations App - #316
Conversation
Deploying Preview to Cloudflare (api)Preview URL: https://codex-api-github-app-auth-api.fossbilling.workers.dev/ (commit
|
| Status | Deployment URL | Commit | Updated (UTC) | Details |
|---|---|---|---|---|
| Build: Success ✅ Deployment: Success ✅ |
https://af9df079-api.fossbilling.workers.dev/ | 011dadd |
2026-11-13T00:17:42.017Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://a8ad0fe6-api.fossbilling.workers.dev/ | 9a35ff1 |
2026-11-12T23:55:03.081Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://58292592-api.fossbilling.workers.dev/ | f68a68c |
2026-11-12T23:21:26.632Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://09e5aadb-api.fossbilling.workers.dev/ | 5f21050 |
2026-11-12T23:00:21.010Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://a4b0e283-api.fossbilling.workers.dev/ | 27ce96d |
2026-11-12T21:43:29.438Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://b0d57f28-api.fossbilling.workers.dev/ | 1fb3386 |
2026-11-12T20:50:29.442Z | View logs ↗ |
| Build: Success ✅ Deployment: Success ✅ |
https://d5f8eb0b-api.fossbilling.workers.dev/ | dc70a28 |
2026-11-12T20:27:37.999Z | View logs ↗ |
Ignore all environment and dev vars files while allowing example dev vars files. Update the private key format and clarify the shared assertion secret.
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 57 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 5 files (changes from recent commits).
Requires human review: Migrates API GitHub reads from a long-lived PAT to short-lived GitHub App installation tokens, adding new GITHUB_APP_* secrets and build/deploy configuration. Because this changes production authentication and credential handling, it requires human sign-off.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Requires human review: Migrates API GitHub reads from a long-lived PAT to GitHub App installation-token auth, adding GITHUB_APP_* secrets and build/deploy config. Decisive: this changes production authentication and credential handling, so a human must approve App scope and confirm the appId/Client ID wiring.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Requires human review: Migrates API GitHub reads from a long-lived PAT to GitHub App installation-token authentication, adding GITHUB_APP_* secrets, build conditions, and a shared Octokit client. Decisive: production authentication and credential handling change, and the App ID/Client ID wiring still needs human sign-off.
Turn on auto-fix | Re-trigger cubic
Replace the API's long-lived GitHub PAT with short-lived FOSSBilling Integrations installation tokens, restricted to
FOSSBilling/FOSSBillingand Contents, Actions and Pull requests read permissions.A shared lazy Octokit REST/GraphQL client serves versions, stats, previews and developer verification.
@octokit/auth-appmanages token issuance, caching and refresh. Cache hits, preview budgets and no-op updates keep their existing behavior; authentication outages remain unavailable rather than becoming missing users or anonymous requests.