{"record":{"id":"b27777588ce17a1d","repo":"JuliusBrussee/caveman","slug":"githubapp-decode-repository-proof-content-w","errorCode":null,"errorMessage":"githubapp: decode repository proof content: %w","messagePattern":"githubapp: decode repository proof content: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/githubapp/githubapp.go","lineNumber":332,"sourceCode":"\t}\n\tif status != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"githubapp: get repository proof: HTTP %d: %s\", status, snippet(raw))\n\t}\n\tvar payload struct {\n\t\tType     string `json:\"type\"`\n\t\tEncoding string `json:\"encoding\"`\n\t\tContent  string `json:\"content\"`\n\t\tSize     int64  `json:\"size\"`\n\t}\n\tif err := json.Unmarshal(raw, &payload); err != nil {\n\t\treturn nil, fmt.Errorf(\"githubapp: decode repository proof: %w\", err)\n\t}\n\tif payload.Type != \"file\" || payload.Encoding != \"base64\" || payload.Size < 0 || payload.Size > 64<<10 {\n\t\treturn nil, fmt.Errorf(\"githubapp: repository proof has invalid type, encoding, or size\")\n\t}\n\tdecoded, err := base64.StdEncoding.DecodeString(strings.ReplaceAll(payload.Content, \"\\n\", \"\"))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"githubapp: decode repository proof content: %w\", err)\n\t}\n\tif len(decoded) > 64<<10 || int64(len(decoded)) != payload.Size {\n\t\treturn nil, fmt.Errorf(\"githubapp: repository proof size mismatch\")\n\t}\n\treturn decoded, nil\n}\n\n// DoToken issues an authenticated GitHub REST call with an installation token and\n// returns the status + raw body for the caller to parse. It is the reusable\n// primitive the worker's PR opener builds the Git Data API flow on, so every\n// GitHub egress goes through the one SSRF-guarded client + fixed base host.\nfunc (a *App) DoToken(ctx context.Context, token, method, path string, body any) (int, []byte, error) {\n\treturn a.do(ctx, \"Bearer \"+token, method, path, body)\n}\n\nfunc (a *App) do(ctx context.Context, authorization, method, path string, body any) (int, []byte, error) {\n\tif !strings.HasPrefix(path, \"/\") || strings.HasPrefix(path, \"//\") || strings.Contains(path, \"\\\\\") {\n\t\treturn 0, nil, fmt.Errorf(\"githubapp: request path must be a single-host absolute path\")","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/githubapp/githubapp.go#L314-L350","documentation":"The contents payload decoded, but the embedded base64 Content field failed base64 decoding while reading the repository proof file. The metadata claimed base64 encoding yet the content string is not valid base64 — corruption in transit or an unexpected GitHub payload variant.","triggerScenarios":"Thrown at shared/platform/githubapp/githubapp.go:332 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-fetch the file; if it persists, verify the file bytes are not corrupted in the repo","Check for proxies/middleware mangling the response body"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}