abstrask opened a new issue, #9220: URL: https://github.com/apache/devlake/issues/9220
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/devlake/issues?q=is%3Aissue) and found no similar issues. ### What happened With a GitHub App connection, blueprint runs fail at plan time: ``` unexpected status code while getting installation access token: {"message":"'Expiration time' claim ('exp') is too far in the future","documentation_url":"https://docs.github.com/rest","status":"401"} (401) ``` `GithubAppKey.CreateJwt` in `backend/plugins/github/models/connection.go` sets `iat = now` and `exp = now + 600`. GitHub rejects a JWT whose `exp` is more than 10 minutes in the future, so any host clock even slightly ahead of GitHub's fails. Our host drifted about 1s ahead: runs failed intermittently below 1s and every time above it. ### What do you expect to happen Tolerate small clock drift, as GitHub recommends: backdate `iat` by 60s and keep `exp` under 10 minutes (e.g. `iat = now - 60`, `exp = now + 540`). ### How to reproduce 1. Create a GitHub App connection and a blueprint using it. 2. Set the DevLake host clock about 2s ahead of real time. 3. Trigger the blueprint. ### Anything else - GitHub docs: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app - Related: `POST /blueprints/:id/trigger` returns GitHub's 401 as its own HTTP 401. config-ui treats any 401 as an expired session and redirects to `/login`, which (with `AUTH_ENABLED` unset) shows "Single Sign-On is not configured". That is misleading for what is an upstream GitHub error. ### Version v1.0.3-beta14 (same code on `main`) ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
