Skip to content

fix: convert app_id to string before login_as_app_installation call#340

Merged
jmeridth merged 1 commit intomainfrom
jm_fix_iss_as_int
Mar 1, 2026
Merged

fix: convert app_id to string before login_as_app_installation call#340
jmeridth merged 1 commit intomainfrom
jm_fix_iss_as_int

Conversation

@jmeridth
Copy link
Collaborator

@jmeridth jmeridth commented Mar 1, 2026

Fixes #333

Pull Request

Proposed Changes

What

Wrapped gh_app_id with str() in the login_as_app_installation call in auth.py, and added a targeted test for integer app_id inputs. Existing tests were also tightened to assert on exact call arguments.

Why

When gh_app_id is passed as an integer, PyJWT raises a TypeError on the iss claim during JWT encoding because it expects a string. This surfaces at runtime when the environment variable is parsed as an int rather than str.

Notes

  • Only gh_app_id is converted; gh_app_installation_id is left as-is since login_as_app_installation accepts it in its original form — reviewers should verify this is intentional
  • The existing tests previously used assert_called_once() without argument checks, so bugs like this were invisible; the tightened assertions now catch argument type mismatches

Readiness Checklist

Author/Contributor

  • If documentation is needed for this change, has that been included in this pull request
  • run make lint and fix any issues that you have introduced
  • run make test and ensure you have test coverage for the lines you are introducing

@jmeridth jmeridth self-assigned this Mar 1, 2026
@jmeridth jmeridth requested a review from zkoppert as a code owner March 1, 2026 08:17
@github-actions github-actions bot added the fix label Mar 1, 2026
Fixes #333

## What

Wrapped `gh_app_id` with `str()` in the `login_as_app_installation` call in
auth.py, and added a targeted test for integer app_id inputs. Existing tests
were also tightened to assert on exact call arguments.

## Why

When `gh_app_id` is passed as an integer, PyJWT raises a TypeError on the
`iss` claim during JWT encoding because it expects a string. This surfaces
at runtime when the environment variable is parsed as an int rather than str.

## Notes

- Only `gh_app_id` is converted; `gh_app_installation_id` is left as-is since `login_as_app_installation` accepts it in its original form — reviewers should verify this is intentional
- The existing tests previously used `assert_called_once()` without argument checks, so bugs like this were invisible; the tightened assertions now catch argument type mismatches

Signed-off-by: jmeridth <jmeridth@gmail.com>
@jmeridth jmeridth force-pushed the jm_fix_iss_as_int branch from 6fb1535 to 3d74307 Compare March 1, 2026 08:17
@jmeridth jmeridth merged commit 2f73601 into main Mar 1, 2026
37 checks passed
@jmeridth jmeridth deleted the jm_fix_iss_as_int branch March 1, 2026 08:22
jmeridth added a commit to github-community-projects/stale-repos that referenced this pull request Mar 3, 2026
Closes #439

## What

Wrapped `gh_app_id` with `str()` in the `login_as_app_installation` call
in auth.py, and added a targeted test for integer app_id inputs. Existing
tests were also tightened to assert on exact call arguments.

## Why

When `gh_app_id` is passed as an integer, PyJWT raises a TypeError on the
`iss` claim during JWT encoding because it expects a string. This surfaces
at runtime when the environment variable is parsed as an int by
`get_int_env_var`.

## Notes

- Only `gh_app_id` is converted; `gh_app_installation_id` is left as-is since `login_as_app_installation` accepts it in its original form
- The existing tests previously used `assert_called_once()` without argument checks, so bugs like this were invisible; the tightened assertions now catch argument type mismatches
- Mirrors the fix in github-community-projects/cleanowners#340

Signed-off-by: jmeridth <jmeridth@gmail.com>
jmeridth added a commit to github-community-projects/measure-innersource that referenced this pull request Mar 3, 2026
### What

Wrapped gh_app_id with str() in the login_as_app_installation call in auth.py,
added targeted tests for integer app_id inputs, and tightened existing test
assertions to verify exact call arguments. Also added .claude local files to
.gitignore.

### Why

When gh_app_id is passed as an integer, PyJWT raises a TypeError on the iss
claim during JWT encoding because it expects a string. This surfaces at runtime
when the environment variable is parsed as an int rather than str.

### Notes

- Only gh_app_id is converted; gh_app_installation_id is left as-is since login_as_app_installation accepts it in its original form
- The existing test previously used assert_called_once() without argument checks, so type mismatches like this were invisible; the tightened assertions now catch them
- Mirrors the fix in github-community-projects/cleanowners#340

Signed-off-by: jmeridth <jmeridth@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TypeError: Issuer (iss) must be a string when using GitHub App authentication

1 participant