feat(draft): resolve a repo's GitHub App by source_id, not the only-App guess (#72 item 8) #82

Merged

dan-claude-bot merged 1 commit from feat/github-app-binding into main

2026-07-16 15:44:02 +00:00

dan-claude-bot commented

2026-07-16 15:22:55 +00:00

(Migrated from github.com)

Implements #72 item 8 — "resolve GitHub App binding via source_id ↔ GET /github-apps instead of the only-App heuristic."

The claim this refutes

inventory --emit-draft wrote the github_apps binding by guessing: with exactly one App on the instance it bound every repo to it ("no other it could be"), and with none or several it left a REVIEW marker on all of them — because "nothing Coolify returns about an application says which App cloned it."

That claim is false at v4.1.2, verified at the source:

An application carries source_id/source_type, and removeSensitiveData hides neither (ApplicationsController.php:39-58). environment_details returns applications un-stripped (ProjectController.php:167).
GET /github-apps returns each App's id and name — only client_secret/webhook_secret are hidden (GithubController::list_github_apps + removeSensitiveData).

So the guess was both unnecessary and, on a single-App instance, silently wrong for any public repo (cloned without a GitHub App, but bound to the one App anyway).

What changed

The draft now matches source_id → App id: each repo binds to the App its application names. Fallbacks preserved and made honest:

A public repo (or any non-GithubApp source_type) resolves to nothing → REVIEW marker (instead of a wrong bind).
A source_id that collides with an App id but carries a non-GithubApp source_type is not mistaken for one.
An instance that will not list its Apps → REVIEW marker (best-effort, unchanged).

The biggest gain is the multi-App instance the old heuristic could not handle at all — it wrote REVIEW on every repo; the lookup resolves each.

semantics.md, the emitted environments.yaml header, and the NO_API_COVERAGE row are corrected to match (the #51 arc: a limitation filed as a defect gets fixed).

Tests

draft.test.ts: binds each repo to its source_id's App with several Apps present; REVIEW for a public repo; no bind on an id-collision with a non-GithubApp source.
draft-cli.test.ts: end-to-end — the incubator app (source_id: 7) resolves to hdb-coolify, the third-party public repo gets a REVIEW marker.

npm run check clean · 511 tests pass (npm run build && npm test, as CI runs).

🤖 Generated with Claude Code

Implements **#72 item 8** — "resolve GitHub App binding via `source_id` ↔ `GET /github-apps` instead of the only-App heuristic." ## The claim this refutes `inventory --emit-draft` wrote the `github_apps` binding by **guessing**: with exactly one App on the instance it bound every repo to it (*"no other it could be"*), and with none or several it left a REVIEW marker on all of them — because *"nothing Coolify returns about an application says which App cloned it."* That claim is false at v4.1.2, verified at the source: - An application carries `source_id`/`source_type`, and `removeSensitiveData` hides **neither** (`ApplicationsController.php:39-58`). `environment_details` returns applications un-stripped (`ProjectController.php:167`). - `GET /github-apps` returns each App's `id` and `name` — only `client_secret`/`webhook_secret` are hidden (`GithubController::list_github_apps` + `removeSensitiveData`). So the guess was both unnecessary and, on a single-App instance, **silently wrong for any public repo** (cloned without a GitHub App, but bound to the one App anyway). ## What changed The draft now **matches `source_id` → App `id`**: each repo binds to the App its application names. Fallbacks preserved and made honest: - A **public repo** (or any non-`GithubApp` `source_type`) resolves to nothing → REVIEW marker (instead of a wrong bind). - A `source_id` that **collides** with an App id but carries a non-GithubApp `source_type` is not mistaken for one. - An instance that will not list its Apps → REVIEW marker (best-effort, unchanged). The biggest gain is the **multi-App instance the old heuristic could not handle at all** — it wrote REVIEW on every repo; the lookup resolves each. `semantics.md`, the emitted `environments.yaml` header, and the `NO_API_COVERAGE` row are corrected to match (the #51 arc: *a limitation filed as a defect gets fixed*). ## Tests - `draft.test.ts`: binds each repo to its `source_id`'s App **with several Apps present**; REVIEW for a public repo; no bind on an id-collision with a non-GithubApp source. - `draft-cli.test.ts`: end-to-end — the incubator app (`source_id: 7`) resolves to `hdb-coolify`, the third-party public repo gets a REVIEW marker. `npm run check` clean · **511 tests pass** (`npm run build && npm test`, as CI runs). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/cast#82

No description provided.