From b0e65423aec6d2741dd52e5e2245614116ec36c6 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Mon, 2 Mar 2026 20:21:53 -0500 Subject: [PATCH] Base64-encode GITHUB_APP_PRIVATE_KEY in .env Write the private key as base64 to avoid multiline quoting issues. Add getGitHubAppPrivateKey() that accepts both raw PEM and base64. Co-Authored-By: Claude Opus 4.6 --- apps/arc-web/app/lib/github.server.ts | 11 +++++++++++ apps/arc-web/app/routes/setup-callback.tsx | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/apps/arc-web/app/lib/github.server.ts b/apps/arc-web/app/lib/github.server.ts index 5e70dde95..7ef6f832a 100644 --- a/apps/arc-web/app/lib/github.server.ts +++ b/apps/arc-web/app/lib/github.server.ts @@ -14,3 +14,14 @@ export function getGitHubOAuth() { export function isGitHubAppConfigured(): boolean { return !!process.env.GITHUB_APP_CLIENT_ID; } + +export function getGitHubAppPrivateKey(): string { + const raw = process.env.GITHUB_APP_PRIVATE_KEY; + if (!raw) { + throw new Error("GITHUB_APP_PRIVATE_KEY is not configured"); + } + if (raw.startsWith("-----BEGIN")) { + return raw; + } + return Buffer.from(raw, "base64").toString("utf-8"); +} diff --git a/apps/arc-web/app/routes/setup-callback.tsx b/apps/arc-web/app/routes/setup-callback.tsx index 82081e036..56a8e2651 100644 --- a/apps/arc-web/app/routes/setup-callback.tsx +++ b/apps/arc-web/app/routes/setup-callback.tsx @@ -46,7 +46,7 @@ export async function loader({ request }: Route.LoaderArgs) { `export GITHUB_APP_CLIENT_ID=${data.client_id}`, `export GITHUB_APP_CLIENT_SECRET=${data.client_secret}`, `export GITHUB_APP_WEBHOOK_SECRET=${data.webhook_secret}`, - `export GITHUB_APP_PRIVATE_KEY="${data.pem}"`, + `export GITHUB_APP_PRIVATE_KEY=${Buffer.from(data.pem).toString("base64")}`, ].join("\n"); const envContent = existing ? `${existing.trimEnd()}\n\n${newVars}\n` : `${newVars}\n`; @@ -57,7 +57,7 @@ export async function loader({ request }: Route.LoaderArgs) { process.env.GITHUB_APP_CLIENT_ID = data.client_id; process.env.GITHUB_APP_CLIENT_SECRET = data.client_secret; process.env.GITHUB_APP_WEBHOOK_SECRET = data.webhook_secret; - process.env.GITHUB_APP_PRIVATE_KEY = data.pem; + process.env.GITHUB_APP_PRIVATE_KEY = Buffer.from(data.pem).toString("base64"); throw redirect("/auth/login"); }