{"record":{"id":"1bfe0f1a619f405f","repo":"bytedance/deer-flow","slug":"github-app-id-is-not-set","errorCode":null,"errorMessage":"GITHUB_APP_ID is not set","messagePattern":"GITHUB_APP_ID is not set","errorType":"exception","errorClass":"GitHubAppAuthError","httpStatus":null,"severity":"error","filePath":"backend/app/gateway/github/app_auth.py","lineNumber":89,"sourceCode":"async def _lock_for(installation_id: int) -> asyncio.Lock:\n    \"\"\"Return the lock dedicated to ``installation_id``, creating on demand.\"\"\"\n    async with _install_locks_lock:\n        lock = _install_locks.get(installation_id)\n        if lock is None:\n            lock = asyncio.Lock()\n            _install_locks[installation_id] = lock\n        return lock\n\n\ndef app_id() -> int:\n    \"\"\"Return the configured GitHub App id, or raise if unset.\n\n    Read fresh on every call so operators can rotate it without a process\n    restart.\n    \"\"\"\n    raw = os.environ.get(_APP_ID_ENV)\n    if not raw:\n        raise GitHubAppAuthError(f\"{_APP_ID_ENV} is not set\")\n    try:\n        return int(raw.strip())\n    except ValueError as exc:\n        raise GitHubAppAuthError(f\"{_APP_ID_ENV}={raw!r} is not an integer\") from exc\n\n\ndef load_app_private_key() -> str:\n    \"\"\"Return the App's RSA private key as a PEM string.\n\n    Reads from ``GITHUB_APP_PRIVATE_KEY`` (inline PEM) if set, else from\n    the path in ``GITHUB_APP_PRIVATE_KEY_PATH``. Inline takes precedence\n    so operators can roll a key by setting an env var instead of moving\n    files around in production.\n    \"\"\"\n    inline = os.environ.get(_PRIVATE_KEY_ENV)\n    if inline and inline.strip():\n        return inline\n","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/github/app_auth.py#L71-L107","documentation":"GitHubAppAuthError raised by app_id() when the GITHUB_APP_ID environment variable is unset or empty. The value is read fresh on every call so operators can rotate it without restart; any caller minting an App JWT (installation token flow) needs it.","triggerScenarios":"Any code path that calls app_id() — mint_app_jwt(), installation token minting — while GITHUB_APP_ID is missing from the Gateway process environment. Typically right after enabling the GitHub App integration without completing env setup.","commonSituations":"GitHub App integration configured in config.yaml but env vars only set in the shell, not in the docker-compose environment or systemd unit; secrets file sourced only in interactive shells; typo in the variable name; CI running integration tests without the GitHub fixture env.","solutions":["Set GITHUB_APP_ID (numeric App id from the GitHub App settings page) in the Gateway process environment: export it in docker/compose env, .env consumed by the orchestrator, or the service unit","Redeploy/restart so the process picks up the env (reads are fresh per call, so a restart is only needed for the env change)","Confirm the sibling vars GITHUB_APP_PRIVATE_KEY (or _PATH) are set too — the next failure is the key","Verify with `docker exec <gateway> printenv GITHUB_APP_ID` or equivalent inside the running process context"],"exampleFix":"# before\ndocker compose up -d   # GITHUB_APP_ID unset -> GitHubAppAuthError: GITHUB_APP_ID is not set\n# after (docker-compose.override.yml)\nservices:\n  gateway:\n    environment:\n      GITHUB_APP_ID: \"123456\"\n      GITHUB_APP_PRIVATE_KEY_PATH: /run/secrets/gh-app-key","handlingStrategy":"validation","validationCode":"import os\nif not os.environ.get('GITHUB_APP_ID'):\n    raise RuntimeError('GITHUB_APP_ID missing — GitHub App auth will raise before any API call')","typeGuard":"null","tryCatchPattern":"try:\n    token = await get_installation_token(inst_id)\nexcept GitHubAppAuthError as e:\n    if 'is not set' in str(e):\n        raise ConfigError('GitHub App env incomplete — set GITHUB_APP_ID/_PRIVATE_KEY(_PATH)')\n    raise","preventionTips":["Add a startup preflight that asserts all three GITHUB_APP_* vars when the GitHub integration is enabled","Declare env vars in compose/systemd so omissions fail at deploy time, not first API call","Use a secrets manager rather than shell exports for service processes"],"tags":["github-app","environment-variables","configuration","auth","integration"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}