fix: adjust expiration time for token generation

[docimin]

GitHub recently tightened JWT validation for GitHub App authentication as the exp claim must now be strictly less than 10 minutes from iat

[greptile-apps]

Greptile Summary

This PR fixes GitHub App JWT authentication by reducing the exp claim from 10 minutes to 9 minutes (60 * 9 seconds) to comply with GitHub's tightened validation that now enforces exp - iat to be strictly less than 10 minutes. The fix also extracts the expiry value into a well-documented constant GITHUB_APP_JWT_EXPIRY and updates the cache TTL to be derived from that constant (GITHUB_APP_JWT_EXPIRY - 60 = 8 minutes) for consistency.

Key changes:

• New constant GITHUB_APP_JWT_EXPIRY = 60 * 9 centralises the 9-minute expiry with documentation linking to GitHub's JWT docs.
• generateAccessToken() now uses self::GITHUB_APP_JWT_EXPIRY (540 s) instead of the previous 10 * 60 (600 s), which was silently rejected by GitHub's stricter validation.
• Cache TTL is now self::GITHUB_APP_JWT_EXPIRY - 60 (480 s / 8 min), preserving the 1-minute refresh buffer before the JWT expires.

Confidence Score: 5/5

Safe to merge — targeted, correct fix with no regressions introduced.

The change is minimal and well-reasoned: it fixes a real compatibility breakage with GitHub's stricter JWT validation by reducing the expiry from 600 s to 540 s, extracts the value into a documented constant, and keeps the cache TTL correctly derived from that constant. No logic errors, security issues, or P1/P0 findings were identified.

No files require special attention.

Vulnerabilities

No security concerns identified. The change reduces the JWT lifetime, which is strictly more conservative from a security standpoint. Private key handling and token usage patterns are unchanged.

Important Files Changed

Filename	Overview
src/VCS/Adapter/Git/GitHub.php	JWT expiry reduced from 10 min to 9 min via new GITHUB_APP_JWT_EXPIRY constant; cache TTL updated to match. Change is correct and well-documented.

_{Reviews (2): Last reviewed commit: "fix: use GITHUB_APP_JWT_EXPIRY instead o..." | Re-trigger Greptile}