Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[Bug][GitHub] GitHub App JWT rejected when host clock is slightly ahead

Ouverte
  • Quelque chose ne va pas ?
#9,220 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 2 jours

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
Une demi-journée
Accessibilité débutants
62/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
github, go
Domaine
authentication, backend

Piste de recherche

Start with CreateJwt on GithubAppKey in backend/plugins/github/models/connection.go, where iat and exp are set from now. The JWT change is the contained part: backdate iat by 60s and keep exp within 10 minutes, then add a unit test that checks the claims. The cron failure path (MakePlanForBlueprint and the blueprint cron runner's logging) is a separate, design-level question about recording a failed pipeline, so scope it apart from the JWT fix.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Search before asking
  • I had searched in the issues and found no similar issues.
What happened

With a GitHub App connection, blueprint runs fail at plan time:

unexpected status code while getting installation access token: {"message":"'Expiration time' claim ('exp') is too far in the future","documentation_url":"https://docs.github.com/rest","status":"401"} (401)

GithubAppKey.CreateJwt in backend/plugins/github/models/connection.go sets iat = now and exp = now + 600. GitHub rejects a JWT whose exp is more than 10 minutes in the future, so any host clock even slightly ahead of GitHub's fails. Our host drifted about 1s ahead: runs failed intermittently below 1s and every time above it.

Scheduled (cron) runs fail silently. The error is raised in MakePlanForBlueprint before any pipeline is created, so no pipeline record exists: nothing shows as a failed run in the UI, and alerting on pipeline status can't catch it. The only trace is the lake log:

[blueprint] run cron job failed on blueprint:[1][Cerivo-Blueprint]
caused by: unexpected status code while getting installation access token: ... (401)
What do you expect to happen

Tolerate small clock drift, as GitHub recommends: backdate iat by 60s and keep exp under 10 minutes (e.g. iat = now - 60, exp = now + 540).

When plan generation fails for a scheduled run, record it as a failed pipeline (or otherwise surface it) instead of only logging it.

How to reproduce
  1. Create a GitHub App connection and a blueprint using it.
  2. Set the DevLake host clock about 2s ahead of real time.
  3. Trigger the blueprint.
Anything else
Version

v1.0.3-beta14 (same code on main)

Are you willing to submit PR?
  • Yes I am willing to submit a PR!
Code of Conduct
Langage dominant
Go
Étoiles
3.2k
Forks
819
Merge moyen
2 j 22 h
PR mergées (30 j)
43

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

  • Aucun Dockerfile ni fichier Docker Compose
  • Propose un modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de apache/devlake

Toutes les issues de apache/devlake

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.