401 Unauthorized errors every hour

Bug Report

https://github.com/tommilligan/prowl-github-app/

Current Behavior I have a probot app running full time on AWS. The app

• listens for events
• performs some long-running (~2 min) checks
• responds to the GitHub API

Occasionally, I get 401 Unauthorized errors back from the API when performing actions:

HttpError: {"message":"Bad credentials","documentation_url":"https://developer.github.com/v3"}
    at response.text.then.message (/usr/src/app/node_modules/@octokit/rest/lib/request/request.js:78:19)
    at <anonymous>
    at process._tickDomainCallback (internal/process/next_tick.js:228:7)

These errors always happen at the same point in the hour - e.g. for a single instance, at 10:05, 11:05, 14:05 and 21:05.

I suspect this is because in the ~2 min check time, the OAuth token attached to the event context expires. This then results in unauthorized requests when calling context.github. New events are received with valid tokens, which do not error.

Expected behavior/code Not to get Unauthorized errors sproradically

Environment

• Probot version(s): 7.0.0
• Node/npm version: node 8.9.4/npm 5.6.0
• OS: Ubuntu 18.04.1 LTS

Possible Solution

Requests to either:

• pass first time by always using the latest token
• on Unauthorized, refresh access token and retry

Additional context/Screenshots

                                    |
+-----------------------------------+------------------------+
|                                                            |
| GitHub API                                                 |
|                                                            |
+-+-----+--------^--------------+---+---+---------^----------+
  |     |        |              |   |   |         |
  v     |event   |action        |       v         |
token   |        |(Authorized)  |   | token       |
  +   +-v------------+          |                 |
  +--->   context    |          |   |             |
  |   +--------------+          |                 |action
  |                             |   |             |(Unauthorized)
  |                            +v---+------------------+
  +---------------------------->  context              |
                               +----+------------------+
                                    |

                                    |
                        probot access_token expires
                                    |

                                    |

[tommilligan]

Thanks for the update! I don’t see any issue with removing the environment variable.

I no longer maintain the app I built (although I hear it’s still kicking at my old workplace). Happy to see probot is still actively developed 🙂

[gr2m]

@tommilligan the custom INSTALLATION_TOKEN_TTL setting should no longer be required with the Probot v10. Installation access tokens are renewed on demand at the time of the request via https://github.com/octokit/auth-app.js/, they are no longer set statically at the time when an event is handled.

Let me know if you see a problem with removing the environment variable

<div> GitHub</div><div>octokit/auth-app.js</div><div>GitHub App authentication for JavaScript. Contribute to octokit/auth-app.js development by creating an account on GitHub.</div>