Module app_jwt 

Authenticating to the forge as the bot App itself.

GitHub serves the installation-reading endpoints to App credentials only: GET /repos/{owner}/{repo}/installation takes a JWT signed with the App’s private key, and no personal access token of any class is accepted there. So the install-bot step observes as the App: rk builds the RS256 signing input, has the OpenSSL CLI sign it with the key bytes on standard input, and carries the resulting token to the forge through curl, in a header read from standard input — the JWT is a credential, and forge-setup:a-secret-never-reaches-argv binds it like any other.

Both spawns deliberately bypass the run’s journaling executor: the executor records child output, the signer’s output is the token’s third segment, and a curl made verbose by a host configuration would echo the very header it was handed. Neither child’s streams reach a journal, an event, or a transcript; the answers surface only as the classified AppApi and the step states built from it.

Structs

AppCredentials

The two halves of the App identity. The caller resolves both — the id from the environment, the key from the run’s one read of the named file — so this module never opens anything itself.

Enums

AppApi

One read-only forge answer, asked as the App itself.

Constants

REMEDIATION

What exporting the credentials would enable, named wherever they are absent.

Functions

api_get

GET https://api.github.com/{path} with the JWT as a bearer token.

app_id

The App id from the environment, absent when unset.

mint

Mint a short-lived RS256 JWT for the App: iss is the App id, iat sits sixty seconds back against clock drift, and exp nine minutes out, inside the forge’s ten-minute cap.