{"record":{"id":"aca48e6215e8fe32","repo":"JuliusBrussee/caveman","slug":"githubapp-installation-id-must-be-positive","errorCode":null,"errorMessage":"githubapp: installation id must be positive","messagePattern":"githubapp: installation id must be positive","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/githubapp/githubapp.go","lineNumber":160,"sourceCode":"\tToken     string    `json:\"token\"`\n\tExpiresAt time.Time `json:\"expires_at\"`\n}\n\n// Installation is the App-authenticated identity GitHub assigns to an install.\n// Callers use it to reject callback-supplied ids that do not belong to this App.\ntype Installation struct {\n\tID      int64 `json:\"id\"`\n\tAccount struct {\n\t\tLogin string `json:\"login\"`\n\t\tID    int64  `json:\"id\"`\n\t} `json:\"account\"`\n}\n\n// GetInstallation verifies an installation id against GitHub using the App JWT.\nfunc (a *App) GetInstallation(ctx context.Context, installationID int64) (Installation, error) {\n\tvar out Installation\n\tif installationID <= 0 {\n\t\treturn out, fmt.Errorf(\"githubapp: installation id must be positive\")\n\t}\n\tjwt, err := a.AppJWT()\n\tif err != nil {\n\t\treturn out, err\n\t}\n\tstatus, raw, err := a.do(ctx, \"Bearer \"+jwt, http.MethodGet,\n\t\t\"/app/installations/\"+strconv.FormatInt(installationID, 10), nil)\n\tif err != nil {\n\t\treturn out, err\n\t}\n\tif status != http.StatusOK {\n\t\treturn out, fmt.Errorf(\"githubapp: get installation: HTTP %d: %s\", status, snippet(raw))\n\t}\n\tif err := json.Unmarshal(raw, &out); err != nil {\n\t\treturn out, fmt.Errorf(\"githubapp: decode installation: %w\", err)\n\t}\n\tif out.ID != installationID || out.Account.ID <= 0 || strings.TrimSpace(out.Account.Login) == \"\" {\n\t\treturn Installation{}, fmt.Errorf(\"githubapp: installation response identity mismatch\")","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/githubapp/githubapp.go#L142-L178","documentation":"Input validation at the top of GetInstallation(): the installation id is zero or negative, so no meaningful GitHub API lookup can be performed. This typically guards against uninitialized or callback-supplied ids before spending a network call.","triggerScenarios":"Thrown at shared/platform/githubapp/githubapp.go:160 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the installation id came from a verified source (callback validation or GetRepoInstallation) and is populated","Validate id > 0 at the caller boundary before invoking GetInstallation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}