From 0d9a39ea237312b1e5e551229801da0f367dc9d8 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 9 Jun 2026 18:32:05 +0200
Subject: [PATCH] fix(github): sync pending app credentials before slug lookup

---
 app/Livewire/Source/Github/Change.php | 14 ++++++++++++--
 bootstrap/helpers/github.php          | 11 +++++++++--
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index aec4cd6d6..17835258b 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -304,7 +304,17 @@ public function updateGithubAppName()
         try {
             $this->authorize('update', $this->github_app);
 
-            if (! PrivateKey::ownedByCurrentTeam()->find($this->github_app->private_key_id)) {
+            $this->github_app->app_id = $this->appId;
+            $this->github_app->private_key_id = $this->privateKeyId;
+            $this->github_app->unsetRelation('privateKey');
+
+            if (! $this->appId) {
+                $this->dispatch('error', 'App ID is required before synchronizing the GitHub App name.');
+
+                return;
+            }
+
+            if (! PrivateKey::ownedByCurrentTeam()->find($this->privateKeyId)) {
                 $this->dispatch('error', 'No private key found for this GitHub App.');
 
                 return;
@@ -314,7 +324,7 @@ public function updateGithubAppName()
 
             if ($appSlug) {
                 $this->name = str($appSlug)->kebab();
-                $this->dispatch('success', 'GitHub App name and SSH key name synchronized successfully.');
+                $this->dispatch('success', 'GitHub App name and private key name synchronized successfully.');
             } else {
                 $this->dispatch('info', 'Could not find App Name (slug) in GitHub response.');
             }
diff --git a/bootstrap/helpers/github.php b/bootstrap/helpers/github.php
index 89233aa38..a2feb3360 100644
--- a/bootstrap/helpers/github.php
+++ b/bootstrap/helpers/github.php
@@ -14,9 +14,9 @@
 use Lcobucci\JWT\Signer\Rsa\Sha256;
 use Lcobucci\JWT\Token\Builder;
 
-function generateGithubToken(GithubApp $source, string $type)
+function assertGithubClockInSync(string $apiUrl): void
 {
-    $response = Http::get("{$source->api_url}/zen");
+    $response = Http::get("{$apiUrl}/zen");
     $serverTime = CarbonImmutable::now()->setTimezone('UTC');
     $githubTime = Carbon::parse($response->header('date'));
     $timeDiff = abs($serverTime->diffInSeconds($githubTime));
@@ -30,6 +30,11 @@ function generateGithubToken(GithubApp $source, string $type)
             'Please synchronize your system clock.'
         );
     }
+}
+
+function generateGithubToken(GithubApp $source, string $type)
+{
+    assertGithubClockInSync($source->api_url);
 
     $signingKey = InMemory::plainText($source->privateKey->private_key);
     $algorithm = new Sha256;
@@ -146,6 +151,8 @@ function syncGithubAppName(GithubApp $source, bool $throw = false): ?string
             return null;
         }
 
+        assertGithubClockInSync($source->api_url);
+
         $jwt = generateGithubAppJwt($privateKey->private_key, $source->app_id);
 
         $response = Http::withHeaders([