GitHub post-installation callback does not preserve state param in this use case...

[RoxKilly]

Select Topic Area

Question

Body

Our GitHub App installation flow is:

1. Create an id on our backend: abc
2. Send user to github.com/apps/<OUR_APP>/installations/new?state=abc (id in the state param)
3. Wait in our post-install callback for state and installation_id in query params, both of which we need to complete the flow

This works fine except when the user directed to github does not have install permissions. In this case, GitHub presents a dialog asking that the user "request" that an admin completes installation. The request is added to the Organization's settings page as a pending install, for an Org admin to install the app.

When the Org admin approves and installs, our callback (step 3 above) is called with the installation_id, however the state from the initial URL is lost and that breaks our install flow.

What is the recommended way to pass state when there is one GitHub user who requests the install, and another later who completes it?

[jamesmoss]

I raised this issue over in https://github.com/orgs/community/discussions/42351 - there's been some discussion there. No mention of a fix though.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[M3tbe]

Problem is still here. Would be great to keep the state sent initially after admin approval on the installation