Unable to add Github app connection: 400 "Unable to validate connection - verify credentials"

[p2bauer]

Describe the bug

I can't seem to successfully add a github app connection to my org (either as a "github app" or oauth). I'm running a self-hosted instance, and followed the directions from https://infisical.com/docs/integrations/app-connections/github#self-hosted-instance. I've confirmed all environment variables are correct.

I've also verified that I'm able to successfully make the rest call to GET https://github.com/login/oauth/access_token myself in postman (using the same code from having F12 open in the browser), so I'm unsure what's the issue.

It doesn't look like the actual exception itself gets logged unfortunately, so I don't actually know what's breaking - but this is the exception handler that fires every time:

infisical/backend/src/services/app-connection/github/github-connection-fns.ts

Line 202 in 874dc01

throw new BadRequestError({

To Reproduce

Steps to reproduce the behavior:

1. Go to 'App Connections' under Organizational Control
2. Click on 'Add Connection', then select 'Github'
3. Give any name, and choose either 'Github app' or 'OAuth' (same error in the end)
4. Authorize the app in github
5. Get redirected back to selfhosted instance, and it takes a while spinning but eventually I get a 400 error: "Unable to validate connection - verify credentials"

Expected behavior

I would expect the github app to be added to the connections list successfully.

Screenshots

Platform you are having the issue on:

Self-hosted via docker-compose (with all environment variables set correctly)

Additional context

Running v0.111.0

One thing I did notice when manually testing in postman GET https://github.com/login/oauth/access_token - the response had an empty scope in the response body, like: ...&scope=&...

I'm not very good at typescript, but I noticed scope is not nullable - could this be an issue?

infisical/backend/src/services/app-connection/github/github-connection-fns.ts

Line 149 in 874dc01

scope: string;

I took a stab at some additional error handling following a model I saw elsewhere in the code, let me know if I should raise a PR: https://github.com/Infisical/infisical/compare/main...p2bauer:infisical:log-validate-github-cred-error?expand=1

[p2bauer]

bump. Does anyone have github secrets sync successfully set up with a self hosted instance? I'm not able to set it up due to this exception.