Repository navigation
feat: find the installation by owner and request newer permissions - #88
Merged
Merged
Conversation
githubauth token --owner acme looks the installation up, so a caller who knows the account no longer needs its numeric ID. It uses the users endpoint, which answers for organizations too, as actions/create-github-app-token does. The lookup is a library function, FindInstallationID, so it shares the Enterprise URL handling and the redirect policy of the token request. InstallationPermissions.Other carries a permission the struct has no field for, such as installation_repositories, so a permission GitHub adds can be requested before a field exists. The CLI still accepts only the names with a field: whether GitHub refuses or ignores an unknown name is untested, and ignoring it would widen the token. AGENTS.md now allows the lookups that minting or ending a token needs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #88 +/- ##
==========================================
+ Coverage 97.43% 97.74% +0.30%
==========================================
Files 8 8
Lines 742 797 +55
==========================================
+ Hits 723 779 +56
+ Misses 19 18 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- FindInstallationID escapes the owner. JoinPath takes escaped elements, so a raw "%" left the JWT-authenticated GET at the API root, and an escaped slash added a path segment. - SIGINT and SIGTERM are held from before the command starts until the token is revoked. A SIGTERM arriving during the revocation used to kill githubauth with the token still valid and the command's exit code lost. - When githubauth itself fails, a failed revocation joins that failure instead of printing a warning, so under --agent stderr stays empty and the one JSON report says the token is still valid. - --owner . and .. exit 2 rather than 1. - The test command now uses its token, and the revoke tests check it did so before the revocation, not merely that a DELETE was sent.
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
To mint a token,
githubauth tokenneeds the installation's numeric ID, which people usually don't know: they know the account the App is installed on.--owner acmenow looks the ID up. Separately, GitHub added App permissions in October 2026 thatInstallationPermissionshas no field for, so library callers could not request them. A newOtherfield carries any permission by GitHub's name.What this does
token --owner acmeacme, then mintstoken --owner acme --installation 9token --owner acmewhere the App is not installed--ownerPermissions: &InstallationPermissions{Other: {"installation_repositories": "write"}}Changes
--ownerandFindInstallationID(ctx, appSrc, owner, opts...)callGET /users/{owner}/installation, which answers for organizations too.InstallationPermissions.Otheris sent alongside the fields. A name set both as a field and inOtherfails before any request.--permissions, and the 404 hint--owner.AGENTS.mdscope rule now allows the lookups that minting or ending a token needs.Rationale
--permissionsin the CLI still accepts only names with a field. Whether GitHub refuses or ignores a name it does not know is untested, and ignoring it would mint a token with every permission the App has. A test with a real App decides when the CLI can send unknown names throughOther.go-github has
Apps.FindUserInstallation. The lookup lives here anyway because it is part of getting a token, and it reuses the token request's Enterprise URL handling and redirect policy.Migration Notes
Only additions to the API, so this fits in v1.12.0 with #87. Before that release, a real App should confirm three things: revocation of the new stateless tokens, GitHub's answer to an unknown permission name, and
--ownerfor an organization.