Stop calling /zen before each installation token request. A short
network problem to GitHub failed deployments with a cURL timeout on
/zen. assertGithubClockInSync now takes the failed response and reads
its Date header, so the "System time is out of sync" error still shows
when GitHub rejects the JWT.
Call it on failed JWT requests in the webhook installation check, the
permission job, the source connection test, and the server transfer
checklist. Remove the /zen fakes from the tests.
The install callback swallowed every verification error (clock skew, network,
missing key, GitHub API errors) and returned an opaque 403. It also compared
the state's team with the session team, so switching teams during the GitHub
install returned 403.
- Return the verification reason, log it, and redirect to the GitHub App page
with an error toast (JSON requests still get 403 with the reason)
- Check membership of the state's team, and switch the session to it
- Show flashed errors on the GitHub App page
Fixes#12122
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- resolve the GitHub App by a stable identifier during installation
callbacks so installing and re-installing keeps working over the
full lifetime of the App
- verify the installation id received from the callback against the
GitHub API before persisting it
- support re-installing an already configured GitHub App instead of
blocking it
- require an authenticated session and rate limit the setup callback
routes
- extend manifest setup state validity to match GitHub's manifest
code lifetime
Adds feature coverage for the GitHub App setup and installation
callbacks.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Andras Bacsai
