GPT-5 finding
Required GitHub App credentials are not validated before use
lowapi-contracthigh
- apps/web/scripts/inspect-app.ts:20-23
- apps/web/scripts/inspect-app-hook.ts:21-24
Both scripts depend on GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY, but rely on the non-null assertion operator. If either env var is missing or malformed, the failure will occur deep inside Octokit with a less actionable error. A simple upfront check would give immediate, clear feedback and prevent confusing stack traces.
Recommendation
Before calling createAppAuth, explicitly validate that process.env.GITHUB_APP_ID and process.env.GITHUB_APP_PRIVATE_KEY are present (and optionally that appId is a valid number/string). If missing, print a clear error (e.g., which variable is missing and expected location .env.local) and exit(1).