[missymessa]

OneLoc currently receives a token for the first GitHub App installation (microsoft) instead of selecting the requested dotnet installation. That causes 403 Resource not accessible by integration when localization tries to create locfiles/* branches or update PRs.

This syncs the focused installation-selection fix already merged in dotnet/arcade#17312 and propagated to dotnet/dotnet main. It flattens the installations response before filtering, requires exactly one owner match, and logs the selected installation.

Evidence:

• The App-token step succeeds, but OneLoc branch/PR writes fail with 403.
• Replaying the same operation with the correctly selected dotnet installation token succeeds.
• The change is limited to �ng/common/Get-GitHubAppToken.ps1 (14 insertions, 4 deletions).

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Fixes GitHub App installation selection in Get-GitHubAppToken.ps1 so OneLoc mints an installation token for the requested owner (e.g., dotnet) rather than implicitly using the first installation returned (e.g., microsoft), preventing 403 “Resource not accessible by integration” failures during branch/PR writes.

Changes:

• Adjusts paging logic to flatten the installations REST response before accumulation to avoid nested-array behavior.
• Filters installations by owner with an explicit “exactly one match” requirement (fail-fast on 0 or >1 matches).
• Logs the selected installation ID and owner for easier troubleshooting.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[himgoyalmicro]

Hey @missymessa there are a few merge conflicts in the PR. Could you please take a look and resolve them?

[missymessa]

This is now superseded by Arcade source flow rather than needing a manual conflict resolution.

The exact installation-selection fix in this PR flowed into main through #11869 (fc9b54a2): it enumerates paged installations, matches InstallationOwner case-insensitively, requires exactly one match, and logs the selected installation. #11932 (81131a70) subsequently updated the same generated script to the current Key Vault secret-based GitHub App implementation while preserving those safeguards.

Because eng/common is Arcade-generated, resolving the conflict in favor of current main leaves this PR with no remaining change. Closing as already incorporated.