fix: handle GitHub OIDC format and error handling#37889
Open
chAwater wants to merge 3 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #37823
Type of change
What does this PR do?
The GitHub OIDC tokens changed from
repo:octocat/my-repo:ref:refs/heads/maintorepo:octocat@123456/my-repo@456789:ref:refs/heads/main(according to the GitHub changelog), breaking theexchange_github_app_tokenendpoint and causing a cryptic failure chain in the GitHub Action log.The root cause is a three-link chain (detailed analysis in the issue #37823):
api.ts— owner/repo parsed incorrectly from new sub formatNew format
repo:octocat@123456/my-repo@456789:ref:…was split as-is, producingoctocat@123456/my-repo@456789, which fails the installation lookup.api.ts— uncaught installation lookup error returns non-JSON 500The failed
getRepoInstallationcall throws through Hono without a catch, so the client receives an HTML/text error page.github.handler.ts— client assumes JSON response, masks the real errorresponse.json()fails on the text body →Failed to parse JSON. Then the catch block callscreateCommentwith an uninitializedoctoRest→undefined is not an object (evaluating 'p.rest'), which buries the real cause.This PR fixes the parsing of new OIDC tokens and adding error handling to expose the real error message.
How did you verify your code works?
The
api.tscannot be tested end-to-end before deployment.I only tested the error handling part using a test repo with test workflow: GitHub Actions logs
Screenshots / recordings
None
Checklist