From fc803bbcda1f2a642389b0aa0206300976710c30 Mon Sep 17 00:00:00 2001
From: jaylfc <jaylfc25@gmail.com>
Date: Sun, 19 Jul 2026 12:15:34 +0100
Subject: [PATCH] fix(github): resolve #2009/#1932 semantic conflict - app key
 comes from SecretsStore

Two green PRs conflicted semantically: #2009 moved the GitHub App private
key from config.yaml into SecretsStore, while #1932 landed a test helper
still stubbing the key on config and returning None for every secret, so
_get_token found neither a PAT nor an App key and the repo endpoint 401'd
on dev.

- routes/github.py: the explicit-installation branch passed the removed
  cfg.github_app_private_key to get_installation_token; use the
  SecretsStore-fetched private_key like the default branch does.
- tests: _build_app_with_app_config now serves the PAT under github_token
  and the App key under github-app-private-key via a name-keyed secrets
  mock, matching the post-#2009 contract.
---
 tests/test_routes_github.py  | 19 ++++++++++++-------
 tinyagentos/routes/github.py |  2 +-
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/tests/test_routes_github.py b/tests/test_routes_github.py
index 530a6feed..e6c0e16f0 100644
--- a/tests/test_routes_github.py
+++ b/tests/test_routes_github.py
@@ -341,18 +341,23 @@ def _build_app_with_app_config(
     app = FastAPI()
     app.include_router(github_router)
 
-    # SecretsStore (PAT)
+    # SecretsStore: PAT under ``github_token``, App key under
+    # ``github-app-private-key`` (moved out of config by #2009).
     mock_secrets = MagicMock()
-    if token:
-        mock_secrets.get = AsyncMock(return_value={"value": token})
-    else:
-        mock_secrets.get = AsyncMock(return_value=None)
+
+    async def _secrets_get(name):
+        if name == "github_token":
+            return {"value": token} if token else None
+        if name == "github-app-private-key":
+            return {"value": "fake-private-key"}
+        return None
+
+    mock_secrets.get = AsyncMock(side_effect=_secrets_get)
     app.state.secrets = mock_secrets
 
-    # App config
+    # App config (private key no longer lives here after #2009)
     mock_config = MagicMock()
     mock_config.github_app_id = "123456"
-    mock_config.github_app_private_key = "fake-private-key"
     app.state.config = mock_config
 
     # App installations store
diff --git a/tinyagentos/routes/github.py b/tinyagentos/routes/github.py
index 1d5b35551..f6fc09865 100644
--- a/tinyagentos/routes/github.py
+++ b/tinyagentos/routes/github.py
@@ -120,7 +120,7 @@ async def _get_app_installation_token(
         from tinyagentos.github_app import get_installation_token
 
         token = await get_installation_token(
-            cfg.github_app_id, cfg.github_app_private_key, installation_id,
+            cfg.github_app_id, private_key, installation_id,
             http_client,
         )
         if token: