Fix scoped installation-token mint that always failed at runtime

**Impact:** pytorch-advisor-coverage lambda (token minting for workflow_dispatch)
**Risk:** low

## What
Mint the scoped installation token via `GithubIntegration.get_access_token` instead of reading `.token` off a standalone `Auth.AppInstallationAuth`, and wrap the call so mint failures name the App and installation ids.

## Why
On PyGithub 2.6.1 `Auth.AppInstallationAuth` only builds its internal integration inside `withRequester`, which never runs until the auth is handed to a `github.Github(...)`. Reading `.token` off the standalone instance therefore always asserts, so the old code path could never actually mint a token at runtime. The previous test passed only because the whole `github` module was mocked, hiding the bug.

# Notes
The test now patches only `GithubIntegration`, exercising the real PyGithub call path so a mint that can't produce a token fails in CI rather than silently passing. A second test covers the wrapped error message, which surfaces the App/installation ids to distinguish a wrong-App key ("A JSON web token could not be decoded") from a genuine outage. Token scoping (`actions:write` only) is unchanged.

Signed-off-by: Jean Schmidt <contato@jschmidt.me>

Author: jeanschmidt

aws/lambda/pytorch-advisor-coverage/advisor_coverage/bootstrap.py

@@ -94,17 +94,29 @@ def _get_secret_from_aws(secret_store_name: str) -> _AWSSecrets:
 def _mint_scoped_installation_token(app_id: str, pem: str, installation_id: int) -> str:
     """Mint an installation token scoped to `actions:write` only.
 
-    Without token_permissions the mint inherits the App's full permission set
+    Without explicit permissions the mint inherits the App's full permission set
     (incl. contents:write → revert-capable). Scoping to actions:write is the
     minimum for workflow_dispatch and removes revert capability entirely.
+
+    Minted through GithubIntegration rather than Auth.AppInstallationAuth:
+    PyGithub (2.6.1) only builds that auth object's internal integration inside
+    `withRequester`, which nothing calls until the auth is handed to a
+    `github.Github(...)`, so reading `.token` off a standalone instance always
+    asserts.
     """
-    app_auth = github.Auth.AppAuth(app_id, pem)
-    inst_auth = github.Auth.AppInstallationAuth(
-        app_auth,
-        installation_id=installation_id,
-        token_permissions=_DISPATCH_TOKEN_PERMISSIONS,
-    )
-    return inst_auth.token
+    integration = github.GithubIntegration(auth=github.Auth.AppAuth(app_id, pem))
+    try:
+        return integration.get_access_token(
+            installation_id, permissions=_DISPATCH_TOKEN_PERMISSIONS
+        ).token
+    except github.GithubException as e:
+        # GitHub answers a key that is validly formed but registered to a
+        # different App with "A JSON web token could not be decoded" — naming the
+        # identifiers is what distinguishes that from a genuine outage.
+        raise RuntimeError(
+            f"Failed to mint an installation token for GITHUB_APP_ID={app_id}, "
+            f"GITHUB_INSTALLATION_ID={installation_id}: {e}"
+        ) from e
 
 
 def setup_clients(config: CoverageConfig) -> None:

aws/lambda/pytorch-advisor-coverage/advisor_coverage/tests/test_advisor_coverage.py

@@ -835,18 +835,39 @@ def test_configure_logging_pins_secret_loggers(self):
         for name in ("github", "github.Requester", "botocore", "boto3", "urllib3"):
             self.assertEqual(logging.getLogger(name).level, logging.WARNING, name)
 
-    @patch("advisor_coverage.bootstrap.github")
-    def test_mint_scopes_token_to_actions_write(self, mock_github):
+    # Patches only GithubIntegration, so the surrounding call path runs against
+    # real PyGithub: a mint that cannot produce a token without a Requester
+    # fails here instead of passing against an all-mocked github module.
+    @patch("advisor_coverage.bootstrap.github.GithubIntegration")
+    def test_mint_scopes_token_to_actions_write(self, mock_integration):
+        import github
+
         from advisor_coverage.bootstrap import _mint_scoped_installation_token
 
-        inst = MagicMock()
-        inst.token = "ghs_scoped"
-        mock_github.Auth.AppInstallationAuth.return_value = inst
+        get_token = mock_integration.return_value.get_access_token
+        get_token.return_value.token = "ghs_scoped"
         token = _mint_scoped_installation_token("app-id", "PEM", 4242)
         self.assertEqual(token, "ghs_scoped")
-        kwargs = mock_github.Auth.AppInstallationAuth.call_args.kwargs
-        self.assertEqual(kwargs["token_permissions"], {"actions": "write"})
-        self.assertEqual(kwargs["installation_id"], 4242)
+        self.assertIsInstance(
+            mock_integration.call_args.kwargs["auth"], github.Auth.AppAuth
+        )
+        args, kwargs = get_token.call_args
+        self.assertEqual(args, (4242,))
+        self.assertEqual(kwargs["permissions"], {"actions": "write"})
+
+    @patch("advisor_coverage.bootstrap.github.GithubIntegration")
+    def test_mint_failure_names_the_identifiers(self, mock_integration):
+        import github
+
+        from advisor_coverage.bootstrap import _mint_scoped_installation_token
+
+        mock_integration.return_value.get_access_token.side_effect = (
+            github.GithubException(401, {"message": "could not be decoded"}, None)
+        )
+        with self.assertRaises(RuntimeError) as ctx:
+            _mint_scoped_installation_token("app-id", "PEM", 4242)
+        self.assertIn("app-id", str(ctx.exception))
+        self.assertIn("4242", str(ctx.exception))
 
     def test_setup_clients_uses_scoped_token(self):
         cfg = make_config(