GitHub platform: getIssueList() returns empty with GitHub App token on GHEC, causing duplicate Dependency Dashboard issues on every run

[torstenzyder]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub Enterprise Server

Which version of Renovate are you using?

43.251.1

Please tell us more about your question or problem

Environment

• Renovate version: 43.251.1 (via ghcr.io/renovatebot/renovate:43-full)
• Platform: GitHub Enterprise Cloud (isGheCloud: true, gheVersion: null)
• GHE endpoint: GitHub Enterprise Cloud (GHEC) with custom domain
• Authentication: GitHub App installation token (via actions/create-github-app-token)
• Runner: GitHub Actions (self-hosted, ubuntu)

---

Describe the bug

When running Renovate with a GitHub App installation token on GitHub Enterprise Cloud,
getIssueList() consistently returns 0 results, even when open issues created by the
bot exist in the target repository. As a result, Renovate creates a new Dependency
Dashboard issue on every single run instead of updating the existing one.

---

Steps to reproduce

1. Set up Renovate using a GitHub App (not a PAT) via renovatebot/github-action
2. Use GitHub Enterprise Cloud as the target platform
3. Run Renovate twice in a row against the same repository
4. Observe: a second "Dependency Dashboard" issue is created instead of the first one
   being updated

---

Expected behavior

Renovate finds the existing open "Dependency Dashboard" issue and updates it in place.

---

Actual behavior

getIssueList() returns 0 issues on every run. findIssue("Dependency Dashboard")
therefore returns null, and ensureIssue() creates a new issue every run.

---

Root cause hypothesis

The GitHub REST API endpoint

GET /repos/{owner}/{repo}/issues?filter=created&state=open

uses filter=created to return "issues created by the currently authenticated user."

With a GitHub App installation token, GitHub Enterprise Cloud appears to interpret
"the currently authenticated user" as scoped to the current token session — not as the
persistent bot account (renovate-bot[bot]). Since a new installation token is
generated on every workflow run, issues created by a previous token are not returned.

This is consistent with the observed behavior: Retrieved 0 issues on every run, even
with open issues present.

In contrast, using the creator query parameter (?creator=renovate-bot%5Bbot%5D)
would search by the stable bot username rather than the transient token session identity.

---

Suggested fix

In lib/modules/platform/github/index.ts, replace filter=created with an explicit
creator={renovateUsername} query parameter in getIssueList():

- `repos/${repo}/issues?filter=created&state=open&per_page=100`
+ `repos/${repo}/issues?creator=${renovateUsername}&state=open&per_page=100`

This would use the stable bot username (my-renovate-bot[bot]) regardless of which
installation token is active in the current run.

---

Workaround

As a temporary workaround, a GitHub Actions step was added that snapshots the existing
Dashboard body before the Renovate run, compares it with the newly created issue after
the run, and closes the duplicate if the content is unchanged (preserving the original
issue number).

---

Platform config from debug log

{
  "hostType": "github",
  "isGHApp": true,
  "isGhe": true,
  "isGheCloud": true,
  "gheVersion": null,
  "userDetails": {
    "username": "my-renovate-bot[bot]",
    "id": 1234567,
    "email": null
  },
  "renovateUsername": "my-renovate-bot[bot]"
}

Logs (if relevant)

Debug log evidence

DEBUG: Retrieving issueList (repository=your-org/your-repo)
DEBUG: Retrieved 0 issues (repository=your-org/your-repo)
DEBUG: Issues cache: Setting 0 issues in cache (repository=your-org/your-repo)
...
DEBUG: findIssue(Dependency Dashboard) (repository=your-org/your-repo)
...
DEBUG: ensureIssue(Dependency Dashboard) (repository=your-org/your-repo)
INFO: Issue created (repository=your-org/your-repo)
DEBUG: Issues cache: Updating issue 57 in cache (repository=your-org/your-repo)

This was observed in consecutive runs with confirmed open issues (#56 was open when the
run creating #57 started).

For comparison, PR fetching works correctly in the same run:

DEBUG: PR cache: Filtered 22 PRs to 6 (user=my-renovate-bot[bot])

PRs are fetched without filter=created and filtered in code — which works. Issues
appear to rely on the filter=created API parameter — which does not.

---

[github-actions[bot]]

Hi there,

You're reporting a problem with an old version of Renovate. Please try the latest version and tell us if that fixes your problem.

Be sure to provide updated logs once you have run with a newer version.

Good luck,

The Renovate team

[RahulGautamSingh]

The filter=created REST call your diff targets was removed in (#27785). Your 43.251.1 already fetches issues over GraphQL, filtered by the stable bot username:

issues(filterBy: { createdBy: $user }, ...)   # $user = renovateUsername = "my-renovate-bot[bot]"`

So creator=renovateUsername is already there the filter keys off the persistent renovateUsername, not the token session. Since this same path runs for all GitHub App users without mass duplicate-dashboard reports, the empty result looks GHEC-specific.

To pin it down:

1. query your open Dashboard issue's author.login. Does it exactly match my-renovate-bot[bot]?
2. And does getIssuesQuery return your issues if you drop the createdBy filter?

If those diverge, the GraphQL createdBy filter is the culprit, and the fix is to filter issues in code by author (like PRs already are) rather than via createdBy for App logins on GHEC.