GitHub App集成Octokit触发401认证错误，请求技术支持

问题描述 #

在Node.js v18环境中使用Octokit v4.0.2开发GitHub App时，处理pull_request.opened webhook事件时调用pulls相关接口（创建评审评论、列出文件、请求评审者）均返回401错误，提示“Must authenticate to access this API”。移除try-catch后报错显示webhook事件payload中缺少“installation”字段。已验证APP_ID、ENTERPRISE_HOSTNAME等所有环境变量配置正确。

代码示例 #

import dotenv from 'dotenv'
import fs from 'fs'
import http from 'http'
import { Octokit, App } from 'octokit'
import { createNodeMiddleware } from '@octokit/webhooks'
import { createAppAuth } from "@octokit/auth-app";

// Load environment variables from .env file
dotenv.config()

// Set configured values
const { APP_ID, ENTERPRISE_HOSTNAME, GITHUB_TOKEN, PRIVATE_KEY_PATH, WEBHOOK_SECRET, CLIENT_ID, CLIENT_SECRET } = process.env

const PRIVATE_KEY = fs.readFileSync(PRIVATE_KEY_PATH, 'utf8')

// Create an authenticated Octokit client authenticated as a GitHub App
const app = new App({
  appId: APP_ID,
  privateKey: PRIVATE_KEY,
  webhooks: {
    secret: WEBHOOK_SECRET
  },
  ...(ENTERPRISE_HOSTNAME && {
    Octokit: Octokit.defaults({
      auth: GITHUB_TOKEN,
      baseUrl: `https://${ENTERPRISE_HOSTNAME}/api/v3`
    })
  })
})

app.webhooks.on('pull_request.opened', async ({ octokit, payload }) => {
  try {
    await octokit.rest.pulls.createReviewComment({
      owner: payload.repository.owner.login,
      repo: payload.repository.name,
      issue_number: payload.pull_request.number,
      body: "Add new code review comment"
    })
  } catch (error) {
    if (error.response) {
      console.error(`Error! Status 3: ${error.response.status}. Message: ${error.response.data.message}`)
    } else {
      console.error(error)
    }
  }

  try {
    const response = await octokit.rest.pulls.listFiles({
      owner: payload.repository.owner.login,
      repo: payload.repository.name,
      issue_number: payload.pull_request.number
    })
    console.log('Response: ', JSON.stringify(response))
  } catch (error) {
    if (error.response) {
      console.error(`Error! Status 4: ${error.response.status}. Message: ${error.response.data.message}`)
    } else {
      console.error(error)
    }
  }

  try {
    await octokit.rest.pulls.requestReviewers({
      owner: payload.repository.owner.login,
      repo: payload.repository.name,
      issue_number: payload.pull_request.number,
      reviewers: ["user1"]
    })
  } catch (error) {
    if (error.response) {
      console.error(`Error! Status 5: ${error.response.status}. Message: ${error.response.data.message}`)
    } else {
      console.error(error)
    }
  }
})

app.webhooks.onError((error) => {
  if (error.name === 'AggregateError') {
    console.log(`Error processing request: ${error.event}`)
  } else {
    console.log(error)
  }
})

// Launch a web server to listen for GitHub webhooks
const port = process.env.PORT || 3004
const path = '/api/webhook'
const localWebhookUrl = `http://localhost:${port}${path}`

// See https://github.com/octokit/webhooks.js/#createnodemiddleware for all options
const middleware = createNodeMiddleware(app.webhooks, { path })

http.createServer(middleware).listen(port, () => {
  console.log(`Server is listening for events at: ${localWebhookUrl}`)
  console.log('Press Ctrl + C to quit.')
})

相关日志输出 #

Error! Status 3: 401. Message: Must authenticate to access this API.
Error! Status 4: 401. Message: Must authenticate to access this API.
Error! Status 5: 401. Message: Must authenticate to access this API.

Without try catch:

AggregateError: 
    HttpError: Unauthorized. "POST /repos/{owner}/{repo}/pulls/{pull_number}/comments" failed most likely due to lack of authentication. Reason: "installation" key missing in webhook event payload
        at file:///Users/user1/Documents/project/mytestapp/node_modules/octokit/node_modules/@octokit/request/dist-bundle/index.js:106:21
        at async requestWithGraphqlErrorHandling (file:///Users/user1/Documents/project/mytestapp/node_modules/octokit/node_modules/@octokit/plugin-retry/dist-bundle/index.js:36:20)
        at async Job.doExecute (/Users/user1/Documents/project/mytestapp/node_modules/bottleneck/light.js:405:18)
    at file:///Users/user1/Documents/project/mytestapp/node_modules/@octokit/webhooks/dist-bundle/index.js:416:19
    at async middleware (file:///Users/user1/Documents/project/mytestapp/node_modules/@octokit/webhooks/dist-bundle/index.js:604:5) {
  event: {
    id: '6fdae3a0-3d0d-11ef-833a-9857aeba7dcd',
    name: 'pull_request',
    payload: {
      action: 'opened',
      number: 62,
      pull_request: [Object],
      repository: [Object],
      enterprise: [Object],
      sender: [Object]
    }
  },
  errors: [
    RequestError [HttpError]: Unauthorized. "POST /repos/{owner}/{repo}/pulls/{pull_number}/comments" failed most likely due to lack of authentication. Reason: "installation" key missing in webhook event payload
        at file:///Users/user1/Documents/project/mytestapp/node_modules/octokit/node_modules/@octokit/request/dist-bundle/index.js:106:21
        at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
        at async requestWithGraphqlErrorHandling (file:///Users/user1/Documents/project/mytestapp/node_modules/octokit/node_modules/@octokit/plugin-retry/dist-bundle/index.js:36:20)
        at async Job.doExecute (/Users/user1/Documents/project/mytestapp/node_modules/bottleneck/light.js:405:18) {
      status: 401,
      request: [Object],
      response: [Object],
      event: [Object]
    }
  ]
}

解决方案 #

1. 检查GitHub App的Webhook与安装状态 #

• 确认GitHub App已安装到目标仓库/组织：未安装的话，webhook payload不会包含installation字段。
• 检查Webhook配置：在GitHub App设置页面，确保Webhook的Content type为application/json，且订阅的Pull requests事件已开启，同时确认事件权限足够（需要仓库的pull request读写权限）。

2. 修正Octokit App初始化配置 #

当前代码全局配置了auth: GITHUB_TOKEN，会覆盖Octokit自动从webhook payload获取安装令牌的逻辑。移除该配置，让App自动处理认证：

const app = new App({
  appId: APP_ID,
  privateKey: PRIVATE_KEY,
  webhooks: {
    secret: WEBHOOK_SECRET
  },
  ...(ENTERPRISE_HOSTNAME && {
    Octokit: Octokit.defaults({
      // 移除auth: GITHUB_TOKEN，保留baseUrl即可
      baseUrl: `https://${ENTERPRISE_HOSTNAME}/api/v3`
    })
  })
})

3. 修正接口参数错误 #

原代码中调用pulls.createReviewComment时使用了issue_number参数，该接口实际需要的是pull_number，修正后：

await octokit.rest.pulls.createReviewComment({
  owner: payload.repository.owner.login,
  repo: payload.repository.name,
  pull_number: payload.pull_request.number, // 替换issue_number为pull_number
  body: "Add new code review comment"
})

pulls.listFiles和pulls.requestReviewers接口同样需要使用pull_number而非issue_number，一并修正。

4. 手动获取安装令牌（fallback方案） #

如果webhook payload仍无法获取installation字段，可通过仓库ID手动获取安装信息并生成令牌：

app.webhooks.on('pull_request.opened', async ({ payload }) => {
  const auth = createAppAuth({
    appId: APP_ID,
    privateKey: PRIVATE_KEY,
    octokit: Octokit.defaults({
      baseUrl: `https://${ENTERPRISE_HOSTNAME}/api/v3`
    })
  });

  // 通过仓库ID获取安装记录
  const { data: installations } = await auth.octokit.rest.apps.listInstallationsForAuthenticatedUser({
    repository_id: payload.repository.id
  });

  if (!installations.length) {
    console.error('App未安装到该仓库');
    return;
  }

  // 获取安装令牌
  const { token } = await auth({
    type: "installation",
    installationId: installations[0].id
  });

  // 创建带令牌的Octokit客户端
  const octokit = new Octokit({
    auth: token,
    baseUrl: `https://${ENTERPRISE_HOSTNAME}/api/v3`
  });

  // 后续接口调用使用此octokit实例
  try {
    await octokit.rest.pulls.createReviewComment({
      owner: payload.repository.owner.login,
      repo: payload.repository.name,
      pull_number: payload.pull_request.number,
      body: "Add new code review comment"
    });
  } catch (error) {
    console.error(error);
  }
});

内容的提问来源于stack exchange，提问作者Ashwin Hegde