githubapp: repository proof has invalid type, encoding, or s

Error message

githubapp: repository proof has invalid type, encoding, or size

What it means

Type/shape guard in GetFileContent(): the payload is not a base64-encoded file entry within the 64 KiB ceiling — wrong type (e.g. directory/symlink), unexpected encoding, or negative/oversized size. Keeps proof retrieval limited to small text files.

Source

Thrown at shared/platform/githubapp/githubapp.go:328

	}
	status, raw, err := a.do(ctx, "Bearer "+token, http.MethodGet, endpoint, nil)
	if err != nil {
		return nil, err
	}
	if status != http.StatusOK {
		return nil, fmt.Errorf("githubapp: get repository proof: HTTP %d: %s", status, snippet(raw))
	}
	var payload struct {
		Type     string `json:"type"`
		Encoding string `json:"encoding"`
		Content  string `json:"content"`
		Size     int64  `json:"size"`
	}
	if err := json.Unmarshal(raw, &payload); err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof: %w", err)
	}
	if payload.Type != "file" || payload.Encoding != "base64" || payload.Size < 0 || payload.Size > 64<<10 {
		return nil, fmt.Errorf("githubapp: repository proof has invalid type, encoding, or size")
	}
	decoded, err := base64.StdEncoding.DecodeString(strings.ReplaceAll(payload.Content, "\n", ""))
	if err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof content: %w", err)
	}
	if len(decoded) > 64<<10 || int64(len(decoded)) != payload.Size {
		return nil, fmt.Errorf("githubapp: repository proof size mismatch")
	}
	return decoded, nil
}

// DoToken issues an authenticated GitHub REST call with an installation token and
// returns the status + raw body for the caller to parse. It is the reusable
// primitive the worker's PR opener builds the Git Data API flow on, so every
// GitHub egress goes through the one SSRF-guarded client + fixed base host.
func (a *App) DoToken(ctx context.Context, token, method, path string, body any) (int, []byte, error) {
	return a.do(ctx, "Bearer "+token, method, path, body)
}

View on GitHub (pinned to 766dce6b13)

Solutions

Point the path at an actual file, not a directory or symlink
Ensure the file is under 64 KiB post-decode; connection proofs are tiny by design

Defensive patterns

Strategy: type-guard

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:328 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/fe0b189e9f727d49. Report an issue: GitHub.