test: Cover stateless GitHub App installation tokens

github/apps_test.go

@@ -8,6 +8,7 @@ package github
 import (
 	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -448,6 +449,35 @@ func TestAppsService_CreateInstallationToken(t *testing.T) {
 	})
 }
 
+// statelessInstallationToken returns a token in the stateless ghs_APPID_JWT
+// format of GitHub App installation tokens, which are about 520 characters long
+// instead of the 40 characters of the legacy format.
+func statelessInstallationToken() string {
+	return "ghs_12345_" + strings.Repeat("h", 36) + "." + strings.Repeat("p", 386) + "." + strings.Repeat("s", 86)
+}
+
+func TestAppsService_CreateInstallationTokenStateless(t *testing.T) {
+	t.Parallel()
+	client, mux, _ := setup(t)
+
+	token := statelessInstallationToken()
+	mux.HandleFunc("/app/installations/1/access_tokens", func(w http.ResponseWriter, r *http.Request) {
+		testMethod(t, r, "POST")
+		fmt.Fprintf(w, `{"token":%q}`, token)
+	})
+
+	ctx := t.Context()
+	got, _, err := client.Apps.CreateInstallationToken(ctx, 1, nil)
+	if err != nil {
+		t.Errorf("Apps.CreateInstallationToken returned error: %v", err)
+	}
+
+	want := &InstallationToken{Token: new(token)}
+	if !cmp.Equal(got, want) {
+		t.Errorf("Apps.CreateInstallationToken returned %+v, want %+v", got, want)
+	}
+}
+
 func TestAppsService_CreateInstallationTokenWithOptions(t *testing.T) {
 	t.Parallel()
 	client, mux, _ := setup(t)

github/github_test.go

@@ -5033,6 +5033,23 @@ func TestNormalizedPort(t *testing.T) {
 	}
 }
 
+func TestClient_statelessInstallationToken(t *testing.T) {
+	t.Parallel()
+	server, auth := authRecorderServer(t)
+
+	token := statelessInstallationToken()
+	client := mustNewClient(t, WithAuthToken(token), WithURLs(&server.URL, &server.URL))
+
+	req, err := client.NewRequest(t.Context(), "GET", server.URL, nil)
+	if err != nil {
+		t.Fatalf("NewRequest returned error: %v", err)
+	}
+	if _, err := client.Do(req, nil); err != nil {
+		t.Fatalf("Do returned error: %v", err)
+	}
+	assertRecordedAuthHeader(t, auth, "Bearer "+token)
+}
+
 // TestClient_tokenOriginScope is the policy's end-to-end guarantee on the
 // default client: a [WithAuthToken] token reaches the client's configured API
 // and upload origins, and no other destination.