github_token: add timeout and status check to env-based fallback

The fallback generateAppInstallationToken used http.DefaultClient which has no timeout. If GitHub API hangs, the handler hangs indefinitely, blocking the workspace credential helper. Fix: use a 15s timeout client and check HTTP status before JSON decode for a cleaner error on 401/403. Related to #1101. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-31 19:58:21 +00:00
1 changed files with 5 additions and 1 deletions
@@ -159,11 +159,15 @@ func generateAppInstallationToken() (string, time.Time, error) {
 	req, _ := http.NewRequest("POST", fmt.Sprintf("https://api.github.com/app/installations/%d/access_tokens", installID), nil)
 	req.Header.Set("Authorization", "Bearer "+signed)
 	req.Header.Set("Accept", "application/vnd.github+json")
-	resp, err := http.DefaultClient.Do(req)
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
 	if err != nil {
 		return "", time.Time{}, err
 	}
 	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", time.Time{}, fmt.Errorf("github API returned status %d", resp.StatusCode)
+	}
 	var result struct {
 		Token     string    `json:"token"`
 		ExpiresAt time.Time `json:"expires_at"`