Issue Accessing Private Repository Attachments with GitHub App Installation Token

[mukul98s]

Select Topic Area

Question

Body

I am encountering an issue with accessing user-attachments from a private repository via a GitHub App. While the URL works perfectly when using a Personal Access Token (PAT), it returns a 404 Not Found error when I use an installation token generated by the GitHub App.

Here are the details:

GitHub App Configuration
• Permissions Granted: contents:read, issues:read-write
• The app is installed with access to two repositories: one public and one private.
• I can successfully access attachments from the public repository using the installation token, but not from the private repository.

Steps Taken

1. Verified Permissions: The app has contents:read and issues:read-write permissions, and it is installed for the private repository.
2. Tested URL: The attachment URL works in the browser and with a PAT, but returns a 404 error when accessed using the app’s installation token.
3. Installation Token Validation:
   • I used the token to list accessible repositories, and the private repository is included in the response.
4. Regenerated Token: I regenerated the installation token after verifying the app’s permissions.

Sample curl Request

Here’s the request I used with the installation token:

curl -H "Authorization: Bearer <installation_token>" \  
     -H "Accept: application/vnd.github.v3+json" \  
     <attachment_url>  

Response: 404 Not Found.

The same request works with a Personal Access Token.

Request for Assistance

Could you help me understand why the GitHub App’s installation token cannot access user-attachments in the private repository? Is there a specific permission or configuration required for accessing such attachments that I might have overlooked?

Thank you for your support!

[ifteneiftene]

Select Topic Area

Question

Body

I am encountering an issue with accessing user-attachments from a private repository via a GitHub App. While the URL works perfectly when using a Personal Access Token (PAT), it returns a 404 Not Found error when I use an installation token generated by the GitHub App.

Here are the details:

GitHub App Configuration
• Permissions Granted: contents:read, issues:read-write
• The app is installed with access to two repositories: one public and one private.
• I can successfully access attachments from the public repository using the installation token, but not from the private repository.

Steps Taken

1. Verified Permissions: The app has contents:read and issues:read-write permissions, and it is installed for the private repository.
2. Tested URL: The attachment URL works in the browser and with a PAT, but returns a 404 error when accessed using the app’s installation token.
3. Installation Token Validation:
   • I used the token to list accessible repositories, and the private repository is included in the response.
4. Regenerated Token: I regenerated the installation token after verifying the app’s permissions.

Sample curl Request

Here’s the request I used with the installation token:

curl -H "Authorization: Bearer <installation_token>" \  
     -H "Accept: application/vnd.github.v3+json" \  
     <attachment_url>  

Response: 404 Not Found.

The same request works with a Personal Access Token.

Request for Assistance

Could you help me understand why the GitHub App’s installation token cannot access user-attachments in the private repository? Is there a specific permission or configuration required for accessing such attachments that I might have overlooked?

Thank you for your support!

[rtpa25]

Damm this is a hard problem am trying to solve this same issue since the last 2 days here's what I have discovered
Installation token is a definite no go
I tried oAuth token of github app still didn't work (this was literally the last arrow in my quiver)

Linear's github sync seems to have achieved this I don't know how they are solving this problem

[mukul98s]

I’m able to retrieve images using a Personal Access Token. However, I believe tokens might not work in this case because the image URLs are hosted on github.com, which doesn’t accept API tokens for direct access.

This is all I know for now. I’ll explore the Linear-GitHub sync further. If you come across any solution, please let me know!

[rtpa25]

Turns out there is actually a way you can fetch the comment from the api (or whatever the attachment is connected to)

    const response = await octokit.request(
      "GET /repos/{owner}/{repo}/issues/comments/{comment_id}",
      {
        owner: repo.githubOwner,
        repo: repo.githubRepoName,
        comment_id: comment.id,
        headers: {
          accept: "application/vnd.github.full+json",
        },
      },
    );

this will return:

1. body: md
2. body_text: plain text
3. body_html: html --> this key will consist of the tag with the image src which will have a short lived jwt attached to it, so you can download it immediately and store it in your own bucket

[mukul98s]

Hey! The issue is resolved now, and I can finally move forward. Thanks a lot for your help!