Module github 

GitHub App auth + status write-back (D21 write-back stage, risk #15).

Credential shape: App JWT (RS256, signed by shelling out to openssl against the operator’s PEM path — the key bytes never pass through this process’s callers) → short-lived installation token → commit-status POST. Permissions required of the App: Commit statuses (read & write) plus, for the queue stage, Pull requests (read), Checks (read), and Contents (read & write) to publish the train branch. Nothing else.

Structs

Pr

An open pull request as the queue sees it.

Enums

Verdict

Aggregate CI verdict for one commit.

Functions

app_jwt

Mints a short-lived (9 min) App JWT for app_id, signing with the RS256 key at pem via the openssl binary.

check_verdict

Fetches the CI verdict for sha (needs App permission Checks: read; GitHub Actions reports through the Checks API).

default_branch

Resolves the repo’s default branch name.

head_sha

Resolves the repo’s default-branch HEAD sha via the API (works on private repos the installation covers).

installation_token

Exchanges the App JWT for an installation token scoped to whatever repos the installation covers.

installations_debug

Returns the raw installations JSON (debug aid: shows the permission set each installation has actually accepted).

list_open_prs

Lists open PRs on repo (needs App permission Pull requests: read).

parse_check_verdict

Parses the response body of GET /commits/{sha}/check-runs into a Verdict. Neutral and skipped conclusions count as success; anything else non-success (failure, cancelled, timed out) fails the train.

parse_prs

Parses the response body of GET /repos/{repo}/pulls into queue entries, oldest PR first (train order = submission order).

post_status

Posts a commit status (state: success/failure/error/pending) on owner/repo@sha under context.