fix test token scoping: override GITHUB_TOKEN via OIDC in ensureGitHubToken

the runner's GITHUB_TOKEN (scoped to pullfrog/app) was leaking into
test subprocesses targeting pullfrog/test-repo, causing 400s from the
Pullfrog API on run-context fetches.

instead of deleting GITHUB_TOKEN from the subprocess env,
ensureGitHubToken now always mints a fresh OIDC token scoped to
GITHUB_REPOSITORY when OIDC is available — replacing any inherited
token with a correctly-scoped one.

also adds an informative throw in acquireTokenViaGitHubApp when
GITHUB_APP_ID/GITHUB_PRIVATE_KEY are missing.

Made-with: Cursor

This commit is contained in:

Colin McDonnell

2026-03-12 06:15:01 +00:00

committed by

pullfrog[bot]

parent 4a8c432a48

commit 250fe7eaa1

6 changed files with 43 additions and 20 deletions

									
										package.json
									
		+1
		-1
	
												View File
												
				@@ -1,6 +1,6 @@

				{

				  "name": "@pullfrog/pullfrog",

				  "version": "0.0.179",

				  "version": "0.0.180",

				  "type": "module",

				  "files": [

				    "index.js",