JuliusBrussee/caveman · error

githubapp: installation id must be positive

Error message

githubapp: installation id must be positive

What it means

Input validation at the top of GetInstallation(): the installation id is zero or negative, so no meaningful GitHub API lookup can be performed. This typically guards against uninitialized or callback-supplied ids before spending a network call.

Source

Thrown at shared/platform/githubapp/githubapp.go:160

	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expires_at"`
}

// Installation is the App-authenticated identity GitHub assigns to an install.
// Callers use it to reject callback-supplied ids that do not belong to this App.
type Installation struct {
	ID      int64 `json:"id"`
	Account struct {
		Login string `json:"login"`
		ID    int64  `json:"id"`
	} `json:"account"`
}

// GetInstallation verifies an installation id against GitHub using the App JWT.
func (a *App) GetInstallation(ctx context.Context, installationID int64) (Installation, error) {
	var out Installation
	if installationID <= 0 {
		return out, fmt.Errorf("githubapp: installation id must be positive")
	}
	jwt, err := a.AppJWT()
	if err != nil {
		return out, err
	}
	status, raw, err := a.do(ctx, "Bearer "+jwt, http.MethodGet,
		"/app/installations/"+strconv.FormatInt(installationID, 10), nil)
	if err != nil {
		return out, err
	}
	if status != http.StatusOK {
		return out, fmt.Errorf("githubapp: get installation: HTTP %d: %s", status, snippet(raw))
	}
	if err := json.Unmarshal(raw, &out); err != nil {
		return out, fmt.Errorf("githubapp: decode installation: %w", err)
	}
	if out.ID != installationID || out.Account.ID <= 0 || strings.TrimSpace(out.Account.Login) == "" {
		return Installation{}, fmt.Errorf("githubapp: installation response identity mismatch")

View on GitHub (pinned to 766dce6b13)

Solutions

1. Ensure the installation id came from a verified source (callback validation or GetRepoInstallation) and is populated
2. Validate id > 0 at the caller boundary before invoking GetInstallation

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:160 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/aca48e6215e8fe32. Report an issue: GitHub.