enforce: warn when app has zero installations - #845
Conversation
When the Allstar GitHub App is authenticated but installed in zero organizations, EnforceAll logged count:0 and EnforceAll complete at Info level and exited silently, leaving operators with no hint that the app simply was not installed anywhere. Emit a Warn-level log in that case stating that authentication succeeded but no installations were found, and point at the missing install step. Add a regression test that exercises the zero-installations path and asserts the warning is produced. Fixes ossf#294 Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
dosubot
Bot
added
the
size:XS
|
This pull request has been marked stale because it has been open for 10 days with no activity |
|
Still active on this. Let me know if there are any changes you'd like or if a maintainer can take a look when they get a chance. |
|
This pull request has been marked stale because it has been open for 10 days with no activity |
There was a problem hiding this comment.
Pull request overview
Adds an operator-facing warning when the Allstar GitHub App authenticates successfully but has zero installations, addressing the “silent no-op” case described in issue #294. This improves debuggability by clearly signaling that the app likely wasn’t installed into any orgs, and includes a regression test for the behavior.
Changes:
- Emit a
Warnlog whenEnforceAllfinds zero installations after successful authentication. - Add
TestEnforceAllNoInstallationsto assert a warn-level log is emitted and no repo listing occurs when there are no installations.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/enforce/enforce.go | Adds a warning log when len(insts) == 0 to signal “authenticated but not installed anywhere”. |
| pkg/enforce/enforce_test.go | Adds a regression test that captures logs and verifies no enforcement occurs when there are zero installations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| getAppInstallations = func(ctx context.Context, ac *github.Client) ([]*github.Installation, error) { | ||
| return []*github.Installation{}, nil | ||
| } | ||
| gaicalled := false | ||
| getAppInstallationRepos = func(ctx context.Context, ic *github.Client) ([]*github.Repository, *github.Response, error) { | ||
| gaicalled = true | ||
| return nil, nil, nil | ||
| } | ||
|
|
||
| // Capture the zerolog global logger output and make sure the warn level is | ||
| // not filtered out, restoring both when the test finishes. | ||
| var buf bytes.Buffer | ||
| savedLogger := log.Logger | ||
| savedLevel := zerolog.GlobalLevel() | ||
| log.Logger = zerolog.New(&buf) | ||
| zerolog.SetGlobalLevel(zerolog.WarnLevel) | ||
| defer func() { | ||
| log.Logger = savedLogger | ||
| zerolog.SetGlobalLevel(savedLevel) | ||
| }() |
| out := buf.String() | ||
| if !strings.Contains(out, "\"level\":\"warn\"") { | ||
| t.Errorf("Expected a warn-level log entry, got: %s", out) | ||
| } |
|
This pull request has been marked stale because it has been open for 10 days with no activity |
Fixes #294
Problem
When the Allstar GitHub App is authenticated but installed in zero organizations,
EnforceAll(inpkg/enforce/enforce.go) lists installations, logscount:0andEnforceAll completeat INFO level, and then iterates an empty slice without enforcing anything. There is no signal that the app simply was not installed anywhere, which is the most common cause. The issue reporter spent time debugging this because invalidPRIVATE_KEY/APP_IDboth produce clear errors, but the much more likely "authenticated but not installed" case is silent.Change
After the existing
Enforcing policies on installations.log, whenlen(insts) == 0, emit alog.Warnstating that authentication succeeded but no installations were found, that no policies will be enforced, and pointing the operator at the install step (app Settings page -> Install App tab). The logging matches the surrounding zerolog style (Str("area", "bot")).Test
Added
TestEnforceAllNoInstallations, which mocksgetAppInstallationsto return an empty slice, captures the zerolog global logger into a buffer, and asserts a warn-level entry mentioning "no installations were found" is produced. It also confirmsgetAppInstallationReposis not called and the results map is empty. I verified the test is a real regression test: it fails against the unpatchedenforce.goand passes with the fix.gofmt -landgo vet ./pkg/enforce/...are both clean on the changed files.Note on docs
The original issue also suggested adding a step to
operator.mddocumenting that the app must be installed into an org. I kept this PR scoped to the code fix and its test so the behavior change is easy to review on its own. Happy to follow up with the docs update (or fold it in here) if maintainers prefer.This commit is DCO signed off (
Signed-off-by).