GitHub App ID makes API fail if a string

[venkatamutyala]

I tried migrating to the github app using these permissions (as documented):

Repository permissions
- Administration: read and write
- Metadata: read
Organization permissions:
- Administration: read and write
- Members: read and write

and keep getting this error:

2025-08-02 18:55:41] INFO: User 'venkatamutyala' is not configured as organization owners. Will make them a normal member
Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.12.11/x64/bin/gh-org-mgr", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/gh_org_mgr/manage.py", line 125, in main
    org.sync_org_owners(dry=args.dry, force=args.force)
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/gh_org_mgr/_gh_org.py", line 329, in sync_org_owners
    if self._is_user_authenticated_user(gh_user):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/gh_org_mgr/_gh_org.py", line 282, in _is_user_authenticated_user
    if user.login == self.gh.get_user().login:
                     ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/AuthenticatedUser.py", line 282, in login
    self._completeIfNotSet(self._login)
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/GithubObject.py", line 543, in _completeIfNotSet
    self._completeIfNeeded()
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/GithubObject.py", line 547, in _completeIfNeeded
    self.__complete()
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/GithubObject.py", line 552, in __complete
    headers, data = self._requester.requestJsonAndCheck("GET", self._url.value, headers=self.__completeHeaders)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/Requester.py", line 624, in requestJsonAndCheck
    return self.__check(
           ^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.11/x64/lib/python3.12/site-packages/github/Requester.py", line 792, in __check
    raise self.createException(status, responseHeaders, data)
github.GithubException.GithubException: Resource not accessible by integration: 403 {"message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/users/users#get-the-authenticated-user", "status": "403"}

Here are screenshots of how i set it up:

[mxmehl]

Thanks for the report.

2025-08-02 18:55:41] INFO: User 'venkatamutyala' is not configured as organization owners. Will make them a normal member

Are you the only owner of the organization? It could well be that the GitHub API denies to remove you as owner because of that.

Also, it'd be helpful if you shared your app config, with any secrets censored.

[venkatamutyala]

Thanks @mxmehl someone else on my team took a look and it appears that I was passing in the app ID as a string and not as an integer and that was causing things to blow up. This might be worth adding a validation for on app startup since the github api doesn't return a useful error message.

[mxmehl]

Thanks @mxmehl someone else on my team took a look and it appears that I was passing in the app ID as a string and not as an integer and that was causing things to blow up. This might be worth adding a validation for on app startup since the github api doesn't return a useful error message.

Oh wow, that's a bug I would have had a hard time thinking of! I'd rather internally convert the type of the string/integer to what the API actually needs.

[mxmehl]

I tried to reproduce the issue with the app ID as string and wasn't successful. This is how my test case looked like:

github_app_id: "1733***"
github_app_private_key: |
  -----BEGIN RSA PRIVATE KEY-----
  [...]

Could you please check what the exact case was so we can pin down the issue?

[venkatamutyala]

Can you try it as a variable using github actions:

below is what we tried:

      - name: Synchronise settings with github-org-manager
        # Uses the folder path from the matrix for the current job
        run: gh-org-mgr sync -c ${{ matrix.config.folder }}
        env:
          # GITHUB_TOKEN: ${{ secrets.GTHB_TOKEN }}
          GITHUB_APP_PRIVATE_KEY: ${{ secrets.GLUEOPS_USER_MANAGEMENT_APP_PRIVATE_KEY }}
          GITHUB_APP_ID: ${{ vars.GLUEOPS_USER_MANAGEMENT_APP_ID }} 

The above is passing it in as env variables to your tool.

Edit: See below reply from allanice001

[allanice001]

we had to set the github app id

GITHUB_APP_ID: 17xxxxx

Looking at this again, it seems I set the app id with quotes around it in the variable, which would have casted it to a string.
Just setting the app id as an integer works as expected

Additionally, there's an extra guard needed as GitHub Apps can’t access /user:

    def _is_user_authenticated_user(self, user: NamedUser) -> bool:
        """Check if a given NamedUser is the authenticated user"""
        try:
            if user.login == self.gh.get_user().login:
                return True
        except github.GithubException as e:
            if e.status == 403 and "Resource not accessible by integration" in str(e):
                return False
            raise
        return False

[mxmehl]

Looking at this again, it seems I set the app id with quotes around it in the variable, which would have casted it to a string.
Just setting the app id as an integer works as expected

GitHub seems to interpret the value "1234" as '"1234"'. I created #126 as an attempt to catch these issues. Can you please test it?