Implement GitHub token auto-refresh with file-based credentials cache

[zyla]

Summary

Fixes 401 "Bad credentials" errors in long-running CI jobs by implementing automatic GitHub App token refresh with file-based credential caching.

Problem

GitHub App installation access tokens expire after 1 hour. Previously, taskrunner created a token once at startup and cached it in an environment variable. For CI jobs longer than 1 hour, subsequent GitHub API calls would fail with:

CommitStatus: Response: {
  "message": "Bad credentials",
  "documentation_url": "https://docs.github.com/rest",
  "status": "401"
}

Solution

Implemented automatic token refresh with the following components:

File-Based Credentials Cache

• Tokens stored in {stateDirectory}/.github-token-cache.json
• Includes both token and ISO8601 expiration timestamp
• Shared across parent and child processes via file system
• Uses file locking to prevent concurrent refresh

Auto-Refresh Logic

• Checks token expiration before each API call
• Refreshes if token expires within 5 minutes
• Both parent and child processes can refresh
• Removes old environment variable approach

Changes Made

1. src/Types.hs - Added expiresAt: UTCTime to GithubClient
2. src/CommitStatus.hs - Implemented cache read/write and refresh logic
3. test/FakeGithubApi.hs - Added configurable token lifetime for testing
4. test/Spec.hs - Added # github token lifetime N test directive
5. test/t/slow/github-token-refresh.txt - New test verifying refresh behavior

Test Plan

• ✅ All existing tests pass
• ✅ New test github-token-refresh verifies token refresh after expiration
  • Sets 2-second token lifetime
  • Sleeps 3 seconds between API calls
  • Confirms multiple token requests occur
• ✅ Tested with both parent and child processes
• ✅ Verified cache file locking prevents concurrent refresh

🤖 Generated with Claude Code

[kozak]

LG