{"record":{"id":"fe0b189e9f727d49","repo":"JuliusBrussee/caveman","slug":"githubapp-repository-proof-has-invalid-type-enco","errorCode":null,"errorMessage":"githubapp: repository proof has invalid type, encoding, or size","messagePattern":"githubapp: repository proof has invalid type, encoding, or size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/githubapp/githubapp.go","lineNumber":328,"sourceCode":"\t}\n\tstatus, raw, err := a.do(ctx, \"Bearer \"+token, http.MethodGet, endpoint, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif status != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"githubapp: get repository proof: HTTP %d: %s\", status, snippet(raw))\n\t}\n\tvar payload struct {\n\t\tType     string `json:\"type\"`\n\t\tEncoding string `json:\"encoding\"`\n\t\tContent  string `json:\"content\"`\n\t\tSize     int64  `json:\"size\"`\n\t}\n\tif err := json.Unmarshal(raw, &payload); err != nil {\n\t\treturn nil, fmt.Errorf(\"githubapp: decode repository proof: %w\", err)\n\t}\n\tif payload.Type != \"file\" || payload.Encoding != \"base64\" || payload.Size < 0 || payload.Size > 64<<10 {\n\t\treturn nil, fmt.Errorf(\"githubapp: repository proof has invalid type, encoding, or size\")\n\t}\n\tdecoded, err := base64.StdEncoding.DecodeString(strings.ReplaceAll(payload.Content, \"\\n\", \"\"))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"githubapp: decode repository proof content: %w\", err)\n\t}\n\tif len(decoded) > 64<<10 || int64(len(decoded)) != payload.Size {\n\t\treturn nil, fmt.Errorf(\"githubapp: repository proof size mismatch\")\n\t}\n\treturn decoded, nil\n}\n\n// DoToken issues an authenticated GitHub REST call with an installation token and\n// returns the status + raw body for the caller to parse. It is the reusable\n// primitive the worker's PR opener builds the Git Data API flow on, so every\n// GitHub egress goes through the one SSRF-guarded client + fixed base host.\nfunc (a *App) DoToken(ctx context.Context, token, method, path string, body any) (int, []byte, error) {\n\treturn a.do(ctx, \"Bearer \"+token, method, path, body)\n}","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/githubapp/githubapp.go#L310-L346","documentation":"Type/shape guard in GetFileContent(): the payload is not a base64-encoded file entry within the 64 KiB ceiling — wrong type (e.g. directory/symlink), unexpected encoding, or negative/oversized size. Keeps proof retrieval limited to small text files.","triggerScenarios":"Thrown at shared/platform/githubapp/githubapp.go:328 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the path at an actual file, not a directory or symlink","Ensure the file is under 64 KiB post-decode; connection proofs are tiny by design"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}