Add unit tests for GitHub App installation-token caching in internal/github/app.go

[Jagadeeshftw]

📌 Description

internal/github/app.go (444 lines) manages GitHub App JWT signing and installation-token exchange. Installation tokens are short-lived (~1h) and should be cached and refreshed proactively; without tests it's unclear whether an expired/near-expired cached token is actually refreshed before use, which could cause a burst of 401s under load.

🧩 Requirements and context

• Add tests for cache hit (valid, non-expiring-soon token reused), cache miss/expiry (token refreshed), and refresh-failure fallback.
• Add a test for concurrent requests during a refresh (should not trigger N redundant token exchanges).
• Document the refresh-ahead window (how long before expiry a refresh is triggered).

Non-functional requirements

• Must be secure, tested, and documented.
• Should be efficient and easy to review.

🛠️ Suggested execution

1. Fork the repo and create a branch

git checkout -b test/github-app-token-cache-coverage

2. Implement changes

• Add test: internal/github/app_test.go (extend existing) with the caching/refresh scenarios.

3. Test and commit

• Run tests:

go test ./internal/github/... -run App -v

• Cover edge cases: token expiring in 30 seconds, GitHub API refresh call failing transiently, 10 concurrent callers during a refresh window.
• Include test output and details in the PR description.

Example commit message

test: add installation-token caching and refresh coverage for internal/github/app.go

✅ Acceptance criteria

• Refresh-ahead window is asserted, not just assumed.
• Concurrent callers during a refresh don't cause a token-exchange stampede.
• A failed refresh surfaces a clear error rather than silently reusing an expired token.

🔒 Security notes

An expired installation token being reused would cause GitHub API calls to fail with 401s in production; a stampede of redundant token exchanges could itself trip GitHub's rate limits. Validate the singleflight/lock behavior under concurrency.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[JClark011]

Hi maintainer Let me work on this issue
I'll definitely give you quick response

[Jagadeeshftw]

Assigned to @JClark011 — go ahead!

[grantfox-oss]

🦊 GrantFox — @JClark011 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #175)
2. Your PR will be reviewed by the Grainlify maintainers

Good luck! Track your progress on GrantFox.