JuliusBrussee/caveman · error

githubapp: decode repository proof content: %w

Error message

githubapp: decode repository proof content: %w

What it means

The contents payload decoded, but the embedded base64 Content field failed base64 decoding while reading the repository proof file. The metadata claimed base64 encoding yet the content string is not valid base64 — corruption in transit or an unexpected GitHub payload variant.

Source

Thrown at shared/platform/githubapp/githubapp.go:332

	}
	if status != http.StatusOK {
		return nil, fmt.Errorf("githubapp: get repository proof: HTTP %d: %s", status, snippet(raw))
	}
	var payload struct {
		Type     string `json:"type"`
		Encoding string `json:"encoding"`
		Content  string `json:"content"`
		Size     int64  `json:"size"`
	}
	if err := json.Unmarshal(raw, &payload); err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof: %w", err)
	}
	if payload.Type != "file" || payload.Encoding != "base64" || payload.Size < 0 || payload.Size > 64<<10 {
		return nil, fmt.Errorf("githubapp: repository proof has invalid type, encoding, or size")
	}
	decoded, err := base64.StdEncoding.DecodeString(strings.ReplaceAll(payload.Content, "\n", ""))
	if err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof content: %w", err)
	}
	if len(decoded) > 64<<10 || int64(len(decoded)) != payload.Size {
		return nil, fmt.Errorf("githubapp: repository proof size mismatch")
	}
	return decoded, nil
}

// DoToken issues an authenticated GitHub REST call with an installation token and
// returns the status + raw body for the caller to parse. It is the reusable
// primitive the worker's PR opener builds the Git Data API flow on, so every
// GitHub egress goes through the one SSRF-guarded client + fixed base host.
func (a *App) DoToken(ctx context.Context, token, method, path string, body any) (int, []byte, error) {
	return a.do(ctx, "Bearer "+token, method, path, body)
}

func (a *App) do(ctx context.Context, authorization, method, path string, body any) (int, []byte, error) {
	if !strings.HasPrefix(path, "/") || strings.HasPrefix(path, "//") || strings.Contains(path, "\\") {
		return 0, nil, fmt.Errorf("githubapp: request path must be a single-host absolute path")

View on GitHub (pinned to 766dce6b13)

Solutions

1. Re-fetch the file; if it persists, verify the file bytes are not corrupted in the repo
2. Check for proxies/middleware mangling the response body

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:332 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/b27777588ce17a1d. Report an issue: GitHub.