Am I "out-of-bounds" on context.github usage?

[kjc17710]

I am using probot v9.15.1.

Recently, our GHE has decided that all of our repos will be set to internal. This has caused an issue to arise in my usage of probot. There are times where I want to read or write to a repo that is outside the current context.

context.github.repos.getContents({
      owner : <different org from context>,
      repo  : <different repo>,
      path  : myPath,
      ref   : branch
    })

Now, prior to changing the repos to internal, these requests worked. But now, with setting the repos to internal, they do not.

I've been looking into the ProbotOctokit and GitHubAPI but I am not clear on how to use them or which one I would need. Is it possible to just "move up" the context and not have to create a new Github instance in order to access a different org/repo?

If I have to use one of those, which one would be best? Do I have to provide a new auth or can I just get that from the existing probot app?

I also tried using app.auth() but I still get "Bad credentials" when trying to get something outside the original context.

[gr2m]

Now, prior to changing the repos to internal, these requests worked. But now, with setting the repos to internal, they do not.

What error do you get? Is the app still installed on all the repositories you are trying to access content from?

[gr2m]

there can be a delay, but usually only up to a few seconds, unless something went wrong. Glad it's working now 👍🏼

[kjc17710]

Ok, bringing this back up. I figured out the case where it was magically working now. But I still have cases where it's not. It seems to be related to the installation_id of the originating context vs the installation_id of the internal repo. Let me setup an example:

I have 2 installations for my application (GitHub app):
Installation_id 1
Access to repoA

Installation_id 2
Access to repoB (internal visibility) - my config which I need to read from for EACH request and write to often
Access to repoC

If my app gets a request from repoC (let's say PR opened), my application will be able to read from and write to repoB just fine.
If my app gets a request from repoA (let's say PR opened), my application will NOT be able to read from and write to repoB, instead giving a 404 Not Found error.

I'm guessing this is due to the installation_id of the request vs the installation_id needed to reach repoB. So in this case, it looks like I am out of bounds on using the installation_id 1 to access a repo under installation_id 2 (i.e. the context of the original request)?

Is there a best suggested method to get around this? Should I attempt to use some exposed additional object (like ProbotOctokit or GitHubAPI) instead of context? Or do I need to use a 3rd party library to make the request external to Probot?

[gr2m]

that is all correct. The app authenticates as an actor using an installation access token, which is scoped to one specific installation. You cannot access resources that are outside the installation your octokit instance is currently authenticated with.

if you get an eventf from repoA but want to update repoC, then you have to create the octokit instance for installation 2 manually:

const installation2Octokit = await app.auth(Installation_2_id)

And then use installation2Octokit to make the request to repo c

[kjc17710]

How would I get that other installation_id for installation 2 if I am currently in context of installation 1? Is that something I would have to be storing over time? Or is that something I can request on the fly?

[gr2m]

the easiest way would be to store the installation ID in an environment variable. You can get the id if you open https://github.com/apps/, go to the install configuration page for the account, and copy the installation ID from the browser's URL

If the installation ID depends on the repository, then you can use this endpoint, authenticated as the app itself: https://docs.github.com/en/rest/reference/apps#get-a-repository-installation-for-the-authenticated-app

const appOctokit = await app.auth()
const { id } = await appOctokit.request('GET /repos/{owner}/{repo}/installation', {
  owner,
  repo
})
const installationOctokit = await app.auth(id)