Conversation
…stall URL (CS-710) (#3371) * fix(integrations): connect GitHub App via OAuth authorize URL, not install URL The install URL (github.com/apps/{slug}/installations/new) dead-ends on GitHub's "manage" page — returning no OAuth code — for any org that already has the App installed, so the connection could never complete on reconnect. Confirmed against GitHub docs + community reports. Switch github-app to the standard OAuth authorize flow (github.com/login/oauth/authorize with the App's client id). This returns a `code` whether or not the App is already installed, shows "Install & Authorize" for first-time users, and honors redirect_uri (so multiple callback URLs on one App route per environment). github-app is now a plain OAuth2 integration whose credentials happen to belong to a read-only GitHub App. Removes the now-obsolete install-flow machinery: the `appInstallFlow` config flag, the install-URL branch + placeholder guard in the controller, and the `{APP_SLUG}` app-slug setting (the authorize URL needs no slug). Also drops the unverified installation_id persistence (the authorize flow returns no installation_id anyway). No change to the legacy `github` integration. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XyttkYNbkdYRp7DBKNuFVH * fix(integrations): verify GitHub App is installed before completing connect GitHub App user authorization and App installation are separate steps: a first-time user can complete login/oauth/authorize WITHOUT installing the App, producing a token that can't read any repositories — a "connected but unusable" integration (flagged by cubic). After the OAuth exchange for github-app, verify the user actually has an installation (GET /user/installations). If GitHub definitively reports none, stop before activating the connection and redirect with a clear "github_app_not_installed" message telling the user to install the App and reconnect. Fails open on any API error/uncertainty so a valid connection is never blocked by a transient failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XyttkYNbkdYRp7DBKNuFVH --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
|
🎉 This PR is included in version 3.99.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.
Summary by cubic
Switches the
github-appintegration to the standard GitHub OAuth authorize flow to fix failed reconnects and ensure proper environment routing, and adds a safeguard to block connection if the App isn’t installed.Bug Fixes
https://github.com/login/oauth/authorizeforgithub-app(always returns an OAuth code and honorsredirect_uri)./user/installations; if none, stop and redirect witherror=github_app_not_installed.Refactors
appInstallFlowand the{APP_SLUG}setting from thegithub-appmanifest and schema; deleted the install-URL branch in the controller; updated tests.Written for commit 51ab7b1. Summary will update on new commits.