fix: Authenticate GitHub App Bot Identity Lookup

[danny-avila]

Summary

I fixed GitHub App worker startup by authenticating the App bot-user lookup with a minted installation token instead of an App JWT. GitHub accepts App JWTs for App and installation operations but rejects them on the user endpoint, which caused upgraded BYOM workers to fail closed with HTTP 401.

• Cache and validate the App bot login through the App-authenticated /app endpoint.
• Mint the repository or fixed-installation token before resolving the bot user identity.
• Authenticate /users/{app}[bot] with the installation token.
• Preserve shared-request cancellation, identity caching, GHES host attribution, and repository-scoped credential caching.
• Assert the authorization class used at every GitHub endpoint.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• npm run build
• node --test dist/github.test.js dist/cli.test.js
• npx tsc --noEmit -p tsconfig.json

Test Configuration:

• macOS arm64
• Node.js 24

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T14:09:56.854935Z	48da3d3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 48da3d3e57

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".