Summary

Allow replacing a GitHub App's private key.

Review Request #15200 — Created July 28, 2026 and updated July 29, 2026, 8:05 a.m.

Information

Owner

david

Repository

Review Board

Branch

release-9.x

Bugs

Depends On

Reviewers

Groups

reviewboard

People

Description

GitHub lets an administrator regenerate an app's private key and revoke

the old one. When that happens the key Review Board has stored can no

longer sign app JWTs, which breaks every installation of the app. There

was no way to recover short of recreating the whole app, since the

app-record account is hidden and has no credential-editing UI.
This adds a "Rotate private key" action to the GitHub App connection. It

accepts a freshly-generated PEM key, validates that it is a usable RSA

private key, and stores it on the app-record account, restoring the

connection in place.

Testing Done


Ran unit tests.
Generated a new private key and uploaded it successfully.

Commits

Summary	ID
Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp

Summary

Allow replacing a GitHub App's private key.

GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.

nqztrxowytwkkklmvmyunyuwuxvlsyvp

Files

Issues

Description	From	Last Updated
continuation line over-indented for visual indent Column: 46 Error code: E127	reviewbot	July 28, 2026, 8:36 a.m.
continuation line over-indented for visual indent Column: 46 Error code: E127	reviewbot	July 28, 2026, 8:37 a.m.
I think we like to put all strings on their own lines now so how about: raise ValueError( 'The private …	maubin	July 29, 2026, 7:56 a.m.
Same here, we can move the ) to its own line.	maubin	July 29, 2026, 7:56 a.m.

flake8 failed.

JSHint passed.

flake8

reviewboard/hostingsvcs/github/views.py (Diff revision 1)
The issue has been dropped. Show all issues
```
continuation line over-indented for visual indent

Column: 46
Error code: E127
```

Commits:

	Summary	ID
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp

Diff:

Revision 2 (+1458 -94)

Show changes

	reviewboard/hostingsvcs/github/accounts.py
	reviewboard/hostingsvcs/github/app_auth.py
	reviewboard/hostingsvcs/github/forms.py
	reviewboard/hostingsvcs/github/service.py
	reviewboard/hostingsvcs/github/views.py
	reviewboard/hostingsvcs/tests/github/base.py
	reviewboard/hostingsvcs/tests/github/test_accounts.py
	reviewboard/hostingsvcs/tests/github/test_app.py
	4 more

Checks run (1 failed, 1 succeeded)

flake8 failed.

JSHint passed.

flake8

reviewboard/hostingsvcs/github/views.py (Diff revision 2)
The issue has been dropped. Show all issues
```
continuation line over-indented for visual indent

Column: 46
Error code: E127
```

Commits:

	Summary	ID
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp

Diff:

Revision 3 (+1458 -94)

Show changes

	reviewboard/hostingsvcs/github/accounts.py
	reviewboard/hostingsvcs/github/app_auth.py
	reviewboard/hostingsvcs/github/forms.py
	reviewboard/hostingsvcs/github/service.py
	reviewboard/hostingsvcs/github/views.py
	reviewboard/hostingsvcs/tests/github/base.py
	reviewboard/hostingsvcs/tests/github/test_accounts.py
	reviewboard/hostingsvcs/tests/github/test_app.py
	4 more

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

reviewboard/hostingsvcs/github/app_auth.py (Diff revision 3)

The issue has been resolved. Show all issues

I think we like to put all strings on their own lines now so how about:
raise ValueError(
    'The private key is not a valid PEM private key.'
) from e

reviewboard/hostingsvcs/github/app_auth.py (Diff revision 3)
The issue has been resolved. Show all issues
```
Same here, we can move the ) to its own line.
```

Commits:

	Summary	ID
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp
	Allow replacing a GitHub App's private key. GitHub lets an administrator regenerate an app's private key and revoke the old one. When that happens the key Review Board has stored can no longer sign app JWTs, which breaks every installation of the app. There was no way to recover short of recreating the whole app, since the app-record account is hidden and has no credential-editing UI. This adds a "Rotate private key" action to the GitHub App connection. It accepts a freshly-generated PEM key, validates that it is a usable RSA private key, and stores it on the app-record account, restoring the connection in place. Testing Done: - Ran unit tests. - Generated a new private key and uploaded it successfully.	nqztrxowytwkkklmvmyunyuwuxvlsyvp

Diff:

Revision 4 (+1458 -94)

Show changes

	reviewboard/hostingsvcs/github/accounts.py
	reviewboard/hostingsvcs/github/app_auth.py
	reviewboard/hostingsvcs/github/forms.py
	reviewboard/hostingsvcs/github/service.py
	reviewboard/hostingsvcs/github/views.py
	reviewboard/hostingsvcs/tests/github/base.py
	reviewboard/hostingsvcs/tests/github/test_accounts.py
	reviewboard/hostingsvcs/tests/github/test_app.py
	4 more

Checks run (2 succeeded)

flake8 passed.

JSHint passed.

Ship it!

```
Ship It!
```