Repository navigation
List a user's private repositories when authenticated as a GitHub App - #539
Merged
josegonzalez merged 1 commit intoOct 28, 2026
Merged
Conversation
With --as-app there is no authenticated user, so a user-account backup
fell through to /users/{user}/repos, which only returns public
repositories. --private silently backed up nothing private.
An installation token can list everything the installation can access
via /installation/repositories, private repositories included. Org
backups keep using /orgs/{org}/repos, and -R still fetches the single
repository directly.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--as-appskips the/userlookup (installation tokens can't call it), so a user-account backup falls through to/users/{user}/repos. That endpoint only returns public repositories, so--privatesilently backs up nothing private. The only sign is the warning "Authenticated user is different from user being backed up".An installation token can list everything the installation can access through
GET /installation/repositories, private repositories included. This uses that endpoint for user-account backups with--as-appand unwraps its{"total_count", "repositories"}pages. Org backups keep using/orgs/{org}/repos, and-Rstill fetches the single repository directly.Testing
tests/test_app_repositories.py: the installation endpoint and page unwrapping, the GHES host, org backups unchanged,-Runchanged. The two listing tests fail without the fix.pytest tests/: 174 passed.flake8with CI's flags andrst-lint README.rstpass./users/{user}/repos. After it, the backup included every repository, private ones too.Independent of #533 and of the private-key work; it applies to pre-minted tokens passed with
-ttoo.🤖 Generated with Claude Code