palantir/policy-bot

AppID ENV Variable not respected

knechtionscoding opened this issue · 2 comments

I'm having trouble getting policy-bot to respond to webhooks against a github enterprise server. When a PR is sent to policy-bot, policy-bot tries to get the contents, and then fails with could not refresh installation id 0's token: received non 2xx response status \"404 Not Found\" I've confirmed that the APP_ID exists properly as an environment variable:

    - env:
      - name: GITHUB_APP_INTEGRATION_ID
        value: "23"

Version being run: image: palantirtechnologies/policy-bot:1.31.0

I'm not sure where/why it is getting 0.

  • I've tried changing the installation/github app
  • I've tried giving it no APP_ID (This fails to even boot, so I know it is reading the env variable).
  • I've tried putting the config directly into the container using a volume mount.

Below is the error:

Full Error ```json {"level":"error","rid":"cjee1do4dgfcqct3qcg0","github_event_type":"pull_request","github_delivery_id":"5a1f9a40-3c43-11ee-89bd-a0d4bbf226bb","error":"failed to load policy: @master: .policy.yml: failed to read file: Get \"https:///api/v3/repos//contents/.policy.yml?ref=master\": could not refresh installation id 0's token: received non 2xx response status \"404 Not Found\" when fetching https:///api/v3/app/installations/0/access_tokens\ngithub.com/palantir/go-githubapp/appconfig.getFileContents\n\t/home/runner/work/policy-bot/policy-bot/vendor/github.com/palantir/go-githubapp/appconfig/appconfig.go:281\ngithub.com/palantir/go-githubapp/appconfig.(*Loader).LoadConfig\n\t/home/runner/work/policy-bot/policy-bot/vendor/github.com/palantir/go-githubapp/appconfig/appconfig.go:126\ngithub.com/palantir/policy-bot/server/handler.(*ConfigFetcher).ConfigForRepositoryBranch\n\t/home/runner/work/policy-bot/policy-bot/server/handler/fetcher.go:41\ngithub.com/palantir/policy-bot/server/handler.(*Base).NewEvalContext\n\t/home/runner/work/policy-bot/policy-bot/server/handler/base.go:82\ngithub.com/palantir/policy-bot/server/handler.(*Base).Evaluate\n\t/home/runner/work/policy-bot/policy-bot/server/handler/base.go:97\ngithub.com/palantir/policy-bot/server/handler.(*PullRequest).Handle\n\t/home/runner/work/policy-bot/policy-bot/server/handler/pull_request.go:59\ngithub.com/palantir/go-githubapp/githubapp.Dispatch.Execute\n\t/home/runner/work/policy-bot/policy-bot/vendor/github.com/palantir/go-githubapp/githubapp/scheduler.go:55\ngithub.com/palantir/go-githubapp/githubapp.(*scheduler).safeExecute\n\t/home/runner/work/policy-bot/policy-bot/vendor/github.com/palantir/go-githubapp/githubapp/scheduler.go:183\ngithub.com/palantir/go-githubapp/githubapp.QueueAsyncScheduler.func1\n\t/home/runner/work/policy-bot/policy-bot/vendor/github.com/palantir/go-githubapp/githubapp/scheduler.go:257\nruntime.goexit\n\t/opt/hostedtoolcache/go/1.20.6/x64/src/runtime/asm_amd64.s:1598","time":"2023-08-16T14:44:07.488257246Z","message":"Unexpected error handling webhook"} ```

Hey @knechtionscoding, sorry you're having trouble getting this working. Did you by chance manually create a webhook on a repository and point it at your Policy Bot server?

There are two different IDs that GitHub Apps use. The application/integration ID identifies the application itself and is what goes in the configuration file. The log message is about an installation ID, which identifies a particular installation of the application on an organization or repository. This ID is generated by GitHub when you install the app and is included in the webhook payload.

When you install an app on an organization/repository, it automatically receives webhooks based on the app's configuration - there's no need to manually create hooks. If you haven't already, make sure the app is configured as described in the README and then try installing it on a repository following the GItHub docs for installing a GitHub App.

That was in fact the problem. Having the manual webhook created vs the webhook from app installation was the problem, and ensuring it was installed properly for that repo vs creating the webhook solved it!