test-companion: sign in as the GitHub App with Bearer, not through gh

gh sends its token as "Authorization: token ...", and GitHub accepts an
App's JWT only as "Authorization: Bearer ...". So every App sign-in
failed with "A JSON web token could not be decoded (HTTP 401)" and the
Action fell back to github-actions[bot], even with the right App ID and
key. Checked against the real App: through gh, 401; with Bearer, 200.

The two calls made as the App (find the installation, get the token)
now use fetch with Bearer. Everything after uses the installation token
through gh as before. The two remaining silent fallbacks now say why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: 2 people

test-companion/src/app-auth.mjs

@@ -24,21 +24,36 @@ export function jwtClaims(appId, nowSeconds) {
 }
 
 /**
- * GitHub's reason a `gh api` call failed, e.g. "Bad credentials (HTTP 401)", for the log.
- * gh's error output holds only the response message, never the token it sent.
+ * Call the GitHub API as the App. Not through gh: gh sends `Authorization: token`,
+ * and GitHub accepts an App's JWT only as `Authorization: Bearer`.
+ * Returns { ok, status, data, reason }; `reason` is GitHub's message, never the JWT.
  */
-export function ghFailureReason(result) {
-	const line = String(result?.stderr ?? "")
-		.split("\n")
-		.map((l) => l.trim())
-		.find(Boolean)
-	return line ? line.replace(/^gh:\s*/, "") : "no detail from GitHub"
+export async function appApi(path, { jwt, method = "GET", body, apiUrl, fetchImpl = fetch } = {}) {
+	const base = String(apiUrl || "https://api.github.com").replace(/\/+$/, "")
+	let response
+	try {
+		response = await fetchImpl(`${base}/${path}`, {
+			method,
+			headers: {
+				Authorization: `Bearer ${jwt}`,
+				Accept: "application/vnd.github+json",
+				"X-GitHub-Api-Version": "2022-11-28",
+				...(body === undefined ? {} : { "Content-Type": "application/json" }),
+			},
+			body: body === undefined ? undefined : JSON.stringify(body),
+		})
+	} catch (e) {
+		return { ok: false, status: 0, data: undefined, reason: `could not reach GitHub: ${e?.message ?? e}` }
+	}
+	const data = await response.json().catch(() => undefined)
+	const reason = response.ok ? "" : `${data?.message || response.statusText || "no detail from GitHub"} (HTTP ${response.status})`
+	return { ok: response.ok, status: response.status, data, reason }
 }
 
 /** What to log when looking up the App's installation on this repository fails. */
 export function installationLookupMessage(result) {
-	const reason = ghFailureReason(result)
-	if (/\bHTTP 404\b/.test(reason)) {
+	const reason = result?.reason || "no detail from GitHub"
+	if (result?.status === 404) {
 		return { level: "notice", text: "Test Companion: the GitHub App is not installed on this repository; using the workflow token." }
 	}
 	return {

test-companion/src/main.mjs

@@ -18,7 +18,7 @@ import {
 	appCredentials,
 	signJwt,
 	installationTokenRequest,
-	ghFailureReason,
+	appApi,
 	installationLookupMessage,
 } from "./app-auth.mjs"
 import { OUTCOMES, parseSummary, resolveOutcome, checkConclusion, stepShouldFail, approvalWasSpent } from "./outcome.mjs"
@@ -168,7 +168,7 @@ function fetchAndCheckout(sha, branch) {
 }
 
 /** A repo-scoped App installation token, or undefined to fall back to the workflow token. */
-function appInstallationToken() {
+async function appInstallationToken() {
 	const creds = appCredentials(env)
 	if (!creds) return undefined
 	// Remove the key from the environment so nothing started later, the agent included, inherits it.
@@ -183,25 +183,22 @@ function appInstallationToken() {
 	}
 
 	// The JWT authenticates the App; only the installation token can touch a repository.
-	const asApp = (args) => runGh(args, { token: jwt })
+	const asApp = (path, opts) => appApi(path, { jwt, apiUrl: env.GITHUB_API_URL, ...opts })
 
-	const found = asApp(["api", `repos/${REPO}/installation`])
-	if (found.status !== 0) {
+	const found = await asApp(`repos/${REPO}/installation`)
+	if (!found.ok) {
 		const { level, text } = installationLookupMessage(found)
-		;(level === "warning" ? warn : notice)(text)
+		if (level === "warning") warn(text)
+		else notice(text)
 		return undefined
 	}
-	let installationId
-	let appLogin
-	try {
-		const installation = JSON.parse(found.stdout)
-		installationId = installation?.id
-		// Adopted only once a token is minted, so a failed mint can't leave us looking under the wrong login.
-		appLogin = installation?.app_slug ? `${installation.app_slug}[bot]` : undefined
-	} catch {
+	const installationId = found.data?.id
+	// Adopted only once a token is minted, so a failed mint can't leave us looking under the wrong login.
+	const appLogin = found.data?.app_slug ? `${found.data.app_slug}[bot]` : undefined
+	if (!installationId) {
+		warn("Test Companion: GitHub's reply about the App's installation had no ID; using the workflow token.")
 		return undefined
 	}
-	if (!installationId) return undefined
 
 	// Scoped to this repository; an empty request gets every repository the installation covers.
 	const scope = installationTokenRequest(REPO)
@@ -210,29 +207,21 @@ function appInstallationToken() {
 		return undefined
 	}
 
-	const mint = (body) =>
-		runGh(["api", `app/installations/${installationId}/access_tokens`, "--method", "POST", "--input", "-"], {
-			token: jwt,
-			input: JSON.stringify(body),
-		})
-
 	// No retry with a smaller request: dropping the permission list asks for everything the installation holds.
-	const minted = mint(scope)
-	if (minted.status !== 0) {
+	const minted = await asApp(`app/installations/${installationId}/access_tokens`, { method: "POST", body: scope })
+	if (!minted.ok) {
 		warn(
-			`Could not get a GitHub App token with the permissions Test Companion needs (${ghFailureReason(minted)}); using the workflow token instead. ` +
+			`Test Companion: could not get a GitHub App token with the permissions it needs (${minted.reason}); using the workflow token instead. ` +
 				"If the App's permissions were changed, an organisation owner may need to accept them.",
 		)
 		return undefined
 	}
 
-	let token
-	try {
-		token = JSON.parse(minted.stdout)?.token
-	} catch {
+	const token = minted.data?.token
+	if (!token) {
+		warn("Test Companion: GitHub's reply had no App token; using the workflow token.")
 		return undefined
 	}
-	if (!token) return undefined
 
 	// Mask before first use.
 	console.log(`::add-mask::${token}`)
@@ -388,7 +377,7 @@ async function main() {
 	}
 
 	// Act as the App when installed, before anything else talks to GitHub.
-	const appToken = appInstallationToken()
+	const appToken = await appInstallationToken()
 	if (appToken) {
 		env.GH_TOKEN = appToken
 		notice("Test Companion: acting as the GitHub App.")

test-companion/test/app-auth.test.mjs

@@ -6,7 +6,7 @@ import {
 	jwtClaims,
 	signJwt,
 	installationTokenRequest,
-	ghFailureReason,
+	appApi,
 	installationLookupMessage,
 } from "../src/app-auth.mjs"
 
@@ -96,24 +96,58 @@ describe("installationTokenRequest", () => {
 	})
 })
 
-describe("App sign-in failures say why", () => {
-	test("GitHub's reason is taken from gh's error output", () => {
-		assert.equal(ghFailureReason({ stderr: "gh: Bad credentials (HTTP 401)\n" }), "Bad credentials (HTTP 401)")
+describe("appApi", () => {
+	const fakeFetch = (status, json, seen) => async (url, init) => {
+		Object.assign(seen, { url, init })
+		return { ok: status >= 200 && status < 300, status, statusText: "", json: async () => json }
+	}
+
+	test("sends the JWT as Bearer, which GitHub requires for an App", async () => {
+		const seen = {}
+		const r = await appApi("repos/o/r/installation", { jwt: "J", fetchImpl: fakeFetch(200, { id: 7 }, seen) })
+		assert.equal(seen.init.headers.Authorization, "Bearer J")
+		assert.equal(seen.url, "https://api.github.com/repos/o/r/installation")
+		assert.deepEqual(r, { ok: true, status: 200, data: { id: 7 }, reason: "" })
+	})
+
+	test("uses the server's API address when given", async () => {
+		const seen = {}
+		await appApi("x", { jwt: "J", apiUrl: "https://ghe.example/api/v3/", fetchImpl: fakeFetch(200, {}, seen) })
+		assert.equal(seen.url, "https://ghe.example/api/v3/x")
+	})
+
+	test("sends a JSON body on POST", async () => {
+		const seen = {}
+		await appApi("x", { jwt: "J", method: "POST", body: { a: 1 }, fetchImpl: fakeFetch(201, {}, seen) })
+		assert.equal(seen.init.method, "POST")
+		assert.equal(seen.init.body, '{"a":1}')
+		assert.equal(seen.init.headers["Content-Type"], "application/json")
+	})
+
+	test("a failure carries GitHub's message and status, never the JWT", async () => {
+		const r = await appApi("x", { jwt: "SECRET-JWT", fetchImpl: fakeFetch(401, { message: "Bad credentials" }, {}) })
+		assert.equal(r.ok, false)
+		assert.equal(r.reason, "Bad credentials (HTTP 401)")
+		assert.doesNotMatch(r.reason, /SECRET-JWT/)
 	})
 
-	test("an empty error output still gives a reason", () => {
-		assert.equal(ghFailureReason({ stderr: "" }), "no detail from GitHub")
-		assert.equal(ghFailureReason(undefined), "no detail from GitHub")
+	test("a network failure is reported, not thrown", async () => {
+		const r = await appApi("x", { jwt: "J", fetchImpl: async () => { throw new Error("ECONNRESET") } })
+		assert.equal(r.ok, false)
+		assert.equal(r.status, 0)
+		assert.match(r.reason, /ECONNRESET/)
 	})
+})
 
+describe("installationLookupMessage", () => {
 	test("only a 404 means the App is not installed", () => {
-		const m = installationLookupMessage({ stderr: "gh: Not Found (HTTP 404)" })
+		const m = installationLookupMessage({ status: 404, reason: "Not Found (HTTP 404)" })
 		assert.equal(m.level, "notice")
 		assert.match(m.text, /not installed on this repository/)
 	})
 
 	test("any other failure is a warning that carries GitHub's reason", () => {
-		const m = installationLookupMessage({ stderr: "gh: A JSON web token could not be decoded (HTTP 401)" })
+		const m = installationLookupMessage({ status: 401, reason: "A JSON web token could not be decoded (HTTP 401)" })
 		assert.equal(m.level, "warning")
 		assert.match(m.text, /A JSON web token could not be decoded \(HTTP 401\)/)
 		assert.doesNotMatch(m.text, /not installed/)