fix(egress): bound anonymous GitHub API authority

.github/workflows/patch-validator-image.yml

@@ -6,7 +6,7 @@ on:
 
 concurrency:
   group: noema-patch-validator-image-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -80,6 +80,17 @@ jobs:
           scanner_dir="$RUNNER_TEMP/noema-binary-scanners"
           mkdir -p "$scanner_dir"
 
+          download_scanner_asset() {
+            destination="$1"
+            url="$2"
+            curl --proto '=https' --tlsv1.2 --location --fail --silent --show-error \
+              --retry 3 \
+              --retry-all-errors \
+              --retry-delay 2 \
+              --retry-max-time 60 \
+              --output "$destination" "$url"
+          }
+
           install_scanner() {
             scanner="$1"
             version="$2"
@@ -88,12 +99,10 @@ jobs:
             checksums="${scanner}_${version}_checksums.txt"
             release_base="https://github.com/anchore/${scanner}/releases/download/v${version}"
 
-            curl --proto '=https' --tlsv1.2 --location --fail --silent --show-error \
-              --output "$scanner_dir/$checksums" "$release_base/$checksums"
+            download_scanner_asset "$scanner_dir/$checksums" "$release_base/$checksums"
             printf '%s  %s\n' "$checksums_sha256" "$scanner_dir/$checksums" | sha256sum --check --strict
 
-            curl --proto '=https' --tlsv1.2 --location --fail --silent --show-error \
-              --output "$scanner_dir/$archive" "$release_base/$archive"
+            download_scanner_asset "$scanner_dir/$archive" "$release_base/$archive"
             (
               cd "$scanner_dir"
               grep -E "^[0-9a-f]{64}  ${archive}$" "$checksums" | sha256sum --check --strict

src/index.ts

@@ -815,20 +815,19 @@ async function resolveInstallationId(
   repository: string,
   env: Env,
 ): Promise<InstallationIdResolution> {
-  if (env.GITHUB_APP_INSTALLATION_ID) {
-    const configuredInstallationId = env.GITHUB_APP_INSTALLATION_ID;
+  const configuredInstallationId = env.GITHUB_APP_INSTALLATION_ID;
+  if (configuredInstallationId) {
     if (!/^[1-9]\d*$/.test(configuredInstallationId)) {
       throw new ApiError("ERR_GITHUB_INSTALLATION", 500, "GitHub App installation id configuration is invalid");
     }
     const numericInstallationId = Number(configuredInstallationId);
     if (!Number.isSafeInteger(numericInstallationId) || String(numericInstallationId) !== configuredInstallationId) {
       throw new ApiError("ERR_GITHUB_INSTALLATION", 500, "GitHub App installation id configuration is invalid");
     }
-    return { value: configuredInstallationId, source: "configured" };
   }
   const now = Date.now();
   const cacheKey = `${env.GITHUB_API_BASE}:${env.GITHUB_APP_ID}:${repository}`;
-  const cached = installationIdCache.get(cacheKey);
+  const cached = configuredInstallationId ? undefined : installationIdCache.get(cacheKey);
   if (cached && cached.expiresAtMs > now) {
     return { value: cached.value, source: "cache" };
   }
@@ -850,11 +849,23 @@ async function resolveInstallationId(
     throw new ApiError("ERR_GITHUB_API", 502, "GitHub API returned invalid installation response");
   }
   const installationId = String(installation.id);
-  installationIdCache.set(cacheKey, {
+  if (configuredInstallationId && installationId !== configuredInstallationId) {
+    throw new ApiError(
+      "ERR_GITHUB_INSTALLATION",
+      500,
+      "GitHub App installation id does not match target repository",
+    );
+  }
+  if (!configuredInstallationId) {
+    installationIdCache.set(cacheKey, {
+      value: installationId,
+      expiresAtMs: now + configuredTtlMs(env.NOEMA_INSTALLATION_CACHE_TTL_SECONDS, 600, 3600),
+    });
+  }
+  return {
     value: installationId,
-    expiresAtMs: now + configuredTtlMs(env.NOEMA_INSTALLATION_CACHE_TTL_SECONDS, 600, 3600),
-  });
-  return { value: installationId, source: "discovery" };
+    source: configuredInstallationId ? "configured" : "discovery",
+  };
 }
 
 async function createInstallationToken(repository: string, env: Env): Promise<InstallationToken> {