fix(github): resolve #2009/#1932 semantic conflict on App private key source

[jaylfc]

Dev is red: test_repo_endpoint_still_uses_app_token fails 401 at the #1932 merge commit. Root cause is a semantic conflict between two individually green PRs: #2009 moved the App private key from config to SecretsStore; #1932 landed with a test helper still stubbing the key on config and a route branch still reading cfg.github_app_private_key.

Fixes:

1. routes/github.py explicit-installation branch now uses the SecretsStore-fetched private_key (the config attribute no longer exists after the fix(security): move GitHub App RSA key from plaintext config to SecretsStore #2009 migration strips it).
2. Test helper serves secrets by name (github_token PAT, github-app-private-key App key) matching the live contract.

Verified locally: tests/test_routes_github.py + tests/test_github_app.py 31/31 pass on 3.12.

Process note: #1932 was merged on a green computed before #2009 changed its base; pitfall 14 in docs/contributor-pitfalls.md (#2040) gets a follow-up line about stale-base greens.

Summary by CodeRabbit

• Bug Fixes
  • GitHub App installation tokens now use the configured application private key when accessing non-user-scoped endpoints.
  • Improved token selection to ensure user credentials are not used for app-level GitHub requests.
• Tests
  • Updated endpoint validation to reflect the revised GitHub credential configuration and token behavior.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b875c5a0-9c5f-43d9-8838-b64e5650a0cb

📥 Commits

Reviewing files that changed from the base of the PR and between 91af53e and fc803bb.

📒 Files selected for processing (2)

• tests/test_routes_github.py
• tinyagentos/routes/github.py

---

📝 Walkthrough

Walkthrough

GitHub App installation-token generation now uses the private key from SecretsStore-backed app state. GitHub route tests update their mocks to provide both the personal token and app private key through the secrets interface.

Changes

GitHub App token resolution

Layer / File(s)	Summary
SecretsStore-backed installation tokens tinyagentos/routes/github.py, tests/test_routes_github.py	_get_app_installation_token passes the loaded SecretsStore private key to token generation, while test app configuration mocks credentials by secret name and retains only the app ID in config.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• jaylfc/taOS#2009: Migrates the GitHub App private key from plaintext configuration to encrypted SecretsStore storage.
• jaylfc/taOS#1932: Updates the GitHub App token-resolution path and related route tests.

Suggested reviewers: hognek

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The route now reads the App key from SecretsStore, but the linked issue also requires config migration and OAuth updates that are not present here.	Add the AppConfig/startup migration and github_oauth.py changes required by #2009, or scope the PR to the route fix only.
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main change: switching GitHub App private-key sourcing to SecretsStore.
Out of Scope Changes check	✅ Passed	The edits stay focused on the GitHub App key source and test setup, with no unrelated code changes apparent.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/github-app-key-semantic-conflict

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• tinyagentos/routes/github.py - 0 issues
• tests/test_routes_github.py - 0 issues

---

_{Reviewed by hy3:free · Input: 36.6K · Output: 1.6K · Cached: 101.4K}