BED-9166: accept app_id for GitHub App JWT issuer

[JimSycurity]

• allow enterprise App credentials to use client_id or app_id
• prefer client_id and reuse the selected issuer for installation JWTs
• tolerate older GHES installation responses without client_id
• add regression coverage for identifier selection and propagation
• document identifier precedence

Summary by CodeRabbit

• New Features

  • GitHub App authentication now supports selecting the JWT issuer from either client_id or app_id.
  • Added validation when neither identifier is provided.
  • Enterprise App credentials now support optional identifiers.
  • Installation responses remain compatible when client_id is unavailable.

• Documentation

  • Added guidance for configuring GitHub App JWT issuers and required credentials.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 472bee3f-6736-4742-868e-5c4b68e2a5b9

📥 Commits

Reviewing files that changed from the base of the PR and between b2fd3f6 and a545f93.

📒 Files selected for processing (4)

• README.md
• src/openhound_github/auth.py
• src/openhound_github/source.py
• tests/test_app_auth.py

---

Walkthrough

Changes

GitHub App JWT issuer

Layer / File(s)	Summary
JWT issuer resolution and authentication state src/openhound_github/auth.py	JWT issuer resolution prefers client_id, falls back to app_id, and raises ValueError when neither is available. Authentication classes use the resolved issuer in JWT claims.
Source authentication wiring src/openhound_github/source.py	Enterprise and organization app authentication pass the resolved JWT issuer to app and installation sessions. Credential identifiers are explicitly optional.
Issuer validation and documentation tests/test_app_auth.py, README.md	Tests cover issuer selection, propagation, legacy installation responses, and enterprise setup. README documents the credential requirements and precedence.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant EnterpriseSource
  participant IssuerResolver
  participant GithubApp
  participant GithubInstallation
  participant GithubSession
  EnterpriseSource->>IssuerResolver: resolve client_id or app_id
  IssuerResolver-->>EnterpriseSource: jwt_issuer
  EnterpriseSource->>GithubApp: pass jwt_issuer
  GithubApp->>GithubSession: create app session
  EnterpriseSource->>GithubInstallation: pass jwt_issuer
  GithubInstallation->>GithubSession: create installation session
  GithubSession->>GithubSession: encode iss claim

Loading

Suggested reviewers: jaredcatkinson, d3vzer0

Poem

I’m a rabbit with a key,
Choosing issuers carefully.
Client first, app next in line,
JWT claims now fit just fine.
Tokens hop from app to nest,
Tests confirm the burrow’s best.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: supporting app_id for GitHub App JWT issuer selection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/BED-9166-app-id-jwt-issuer

---

_{Comment @coderabbitai help to get the list of available commands.}

[jaredcatkinson]

This looks good to me