shipit-engine 0.30.0 → 0.34.0

data/test/unit/commands_test.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'test_helper'
 
 module Shipit

data/test/unit/commit_serializer_test.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Shipit
+  class CommitSerializerTest < ActiveSupport::TestCase
+    test 'commit includes author object' do
+      commit = shipit_commits(:first)
+
+      serializer = ActiveModel::Serializer.serializer_for(commit)
+      assert_equal CommitSerializer, serializer
+      serialized = serializer.new(commit).to_json
+
+      assert_json_document(serialized, "author.name", commit.author.name)
+    end
+  end
+end

data/test/unit/csv_serializer_test.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'test_helper'
 
 module Shipit
@@ -28,7 +29,7 @@ module Shipit
     def assert_dumped(expected, object)
       message = "Expected CSVSerializer.dump(#{object.inspect}) to eq #{expected.inspect}"
       if expected.nil?
-        assert_nil Shipit::CSVSerializer.dump(object), message
+        assert_nil(Shipit::CSVSerializer.dump(object), message)
       else
         assert_equal(expected, Shipit::CSVSerializer.dump(object), message)
       end
@@ -37,7 +38,7 @@ module Shipit
     def assert_loaded(expected, payload)
       message = "Expected CSVSerializer.load(#{payload.inspect}) to eq #{expected.inspect}"
       if expected.nil?
-        assert_nil Shipit::CSVSerializer.load(payload), message
+        assert_nil(Shipit::CSVSerializer.load(payload), message)
       else
         assert_equal(expected, Shipit::CSVSerializer.load(payload), message)
       end

data/test/unit/deploy_commands_test.rb

@@ -1,16 +1,18 @@
+# frozen_string_literal: true
 require 'test_helper'
 
 module Shipit
   class DeployCommandsTest < ActiveSupport::TestCase
     def setup
-      @stack = shipit_stacks(:shipit)
       @deploy = shipit_deploys(:shipit_pending)
+      @stack = @deploy.stack
+      @stack.stubs(:clear_git_cache!)
       @commands = DeployCommands.new(@deploy)
       @deploy_spec = stub(
         dependencies_steps!: ['bundle install --some-args'],
         deploy_steps!: ['bundle exec cap $ENVIRONMENT deploy'],
         rollback_steps!: ['bundle exec cap $ENVIRONMENT deploy:rollback'],
-        machine_env: {'GLOBAL' => '1'},
+        machine_env: { 'GLOBAL' => '1' },
         directory: nil,
         clear_working_directory?: true,
       )
@@ -20,59 +22,114 @@ module Shipit
     end
 
     test "#fetch calls git fetch if repository cache already exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(true)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+
       command = @commands.fetch
+
       assert_equal %w(git fetch origin --tags master), command.args
     end
 
     test "#fetch calls git fetch in git_path directory if repository cache already exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(true)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+
       command = @commands.fetch
-      assert_equal @stack.git_path, command.chdir
+
+      assert_equal @stack.git_path.to_s, command.chdir
     end
 
     test "#fetch calls git clone if repository cache do not exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
+
+      command = @commands.fetch
+
+      expected = %W(git clone --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args.map(&:to_s)
+    end
+
+    test "#fetch calls git clone if repository cache is empty" do
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(true)
+
+      command = @commands.fetch
+
+      expected = %W(git clone --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args
+    end
+
+    test "#fetch calls git clone if repository cache corrupt" do
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+      StackCommands.any_instance.expects(:git_cmd_succeeds?)
+        .with(@stack.git_path)
+        .returns(false)
+
       command = @commands.fetch
+
+      expected = %W(git clone --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args
+    end
+
+    test "#fetch clears a corrupted git stash before cloning" do
+      @stack.expects(:clear_git_cache!)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+      StackCommands.any_instance.expects(:git_cmd_succeeds?)
+        .with(@stack.git_path)
+        .returns(false)
+
+      command = @commands.fetch
+
       expected = %W(git clone --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
       assert_equal expected, command.args
     end
 
     test "#fetch does not use --single-branch if git is outdated" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
       StackCommands.stubs(git_version: Gem::Version.new('1.7.2.30'))
+
       command = @commands.fetch
+
       expected = %W(git clone --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
-      assert_equal expected, command.args
+      assert_equal expected, command.args.map(&:to_s)
     end
 
     test "#fetch calls git fetch in base_path directory if repository cache do not exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
+
       command = @commands.fetch
-      assert_equal @stack.deploys_path, command.chdir
+
+      assert_equal @stack.deploys_path.to_s, command.chdir
     end
 
     test "#fetch merges Shipit.env in ENVIRONMENT" do
       Shipit.stubs(:env).returns("SPECIFIC_CONFIG" => 5)
       command = @commands.fetch
-      assert_equal 5, command.env["SPECIFIC_CONFIG"]
+      assert_equal '5', command.env["SPECIFIC_CONFIG"]
+    end
+
+    test "#env uses the correct Github token for a stack" do
+      Shipit.github(organization: 'shopify').stubs(:token).returns('aS3cr3Tt0kEn')
+      command = @commands.fetch
+      assert_equal 'aS3cr3Tt0kEn', command.env["GITHUB_TOKEN"]
     end
 
     test "#clone clones the repository cache into the working directory" do
       commands = @commands.clone
       assert_equal 2, commands.size
       clone_args = [
-        'git', 'clone', '--local',
-        '--origin', 'cache',
-        @stack.git_path, @deploy.working_directory
+        'git', 'clone', '--quiet',
+        '--local', '--origin', 'cache',
+        @stack.git_path.to_s, @deploy.working_directory,
       ]
       assert_equal clone_args, commands.first.args
-      assert_equal ['git', 'remote', 'add', 'origin', @stack.repo_git_url], commands.second.args
+      assert_equal ['git', 'remote', 'add', 'origin', @stack.repo_git_url.to_s], commands.second.args
     end
 
     test "#clone clones the repository cache from the deploys_path" do
       commands = @commands.clone
-      assert_equal @stack.deploys_path, commands.first.chdir
+      assert_equal @stack.deploys_path.to_s, commands.first.chdir
     end
 
     test "#checkout checks out the deployed commit" do
@@ -181,7 +238,7 @@ module Shipit
     test "#install_dependencies merges Shipit.env in ENVIRONMENT" do
       Shipit.stubs(:env).returns("SPECIFIC_CONFIG" => 5)
       command = @commands.install_dependencies.first
-      assert_equal 5, command.env["SPECIFIC_CONFIG"]
+      assert_equal '5', command.env["SPECIFIC_CONFIG"]
     end
 
     test "#install_dependencies merges machine_env in ENVIRONMENT" do
@@ -190,7 +247,7 @@ module Shipit
     end
 
     test "the deploy's `env` is merged in ENVIRONMENT" do
-      @deploy.env = {'FOO' => 'BAR'}
+      @deploy.env = { 'FOO' => 'BAR' }
       command = @commands.install_dependencies.first
       assert_equal 'BAR', command.env['FOO']
     end

data/test/unit/deploy_serializer_test.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Shipit
+  class DeploySerializerTest < ActiveSupport::TestCase
+    test 'deploy commits includes author object' do
+      deploy = shipit_deploys(:shipit)
+      first_commit_author = deploy.commits.first.author
+
+      serializer = ActiveModel::Serializer.serializer_for(deploy)
+      assert_equal DeploySerializer, serializer
+      serialized = serializer.new(deploy).to_json
+
+      assert_json_document(serialized, "commits.0.author.name", first_commit_author.name)
+    end
+  end
+end

data/test/unit/environment_variables_test.rb

@@ -1,11 +1,12 @@
+# frozen_string_literal: true
 require 'test_helper'
 
 module Shipit
   class EnvironmentVariablesTest < ActiveSupport::TestCase
     def setup
       variable_defs = [
-        {"name" => "FOO", "title" => "Set to 0 to foo", "default" => 1},
-        {"name" => "BAR", "title" => "Set to 1 to bar", "default" => 0},
+        { "name" => "FOO", "title" => "Set to 0 to foo", "default" => 1 },
+        { "name" => "BAR", "title" => "Set to 1 to bar", "default" => 0 },
       ]
       @variable_definitions = variable_defs.map(&VariableDefinition.method(:new))
     end
@@ -16,7 +17,7 @@ module Shipit
     end
 
     test 'correctly sanitizes env variables' do
-      env = {'FOO' => 1, 'BAR' => 1}
+      env = { 'FOO' => 1, 'BAR' => 1 }
       assert_equal env, EnvironmentVariables.with(env).permit(@variable_definitions)
     end
 
@@ -27,7 +28,7 @@ module Shipit
     end
 
     test 'throws an exception when a variable is not whitelisted' do
-      env = {'UNSAFE_VARIABLE' => 1}
+      env = { 'UNSAFE_VARIABLE' => 1 }
       assert_raises(EnvironmentVariables::NotPermitted) do
         EnvironmentVariables.with(env).permit(@variable_definitions)
       end

data/test/unit/github_app_test.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'test_helper'
 
 module Shipit
@@ -17,7 +18,7 @@ module Shipit
 
     test "#initialize doesn't raise if given an empty config" do
       assert_nothing_raised do
-        GitHubApp.new({})
+        GitHubApp.new(nil, {})
       end
     end
 
@@ -182,7 +183,6 @@ module Shipit
           .any_instance
           .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
           .returns(second_token)
-
         first_token = valid_app.token
 
         first_cached_token = Rails.cache.fetch(@token_cache_key)
@@ -198,7 +198,7 @@ module Shipit
     private
 
     def app(extra_config = {})
-      GitHubApp.new(default_config.deep_merge(extra_config))
+      GitHubApp.new(nil, default_config.deep_merge(extra_config))
     end
 
     def default_config

data/test/unit/github_apps_test.rb

@@ -0,0 +1,416 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Shipit
+  class GitHubAppsTestOrgOne < ActiveSupport::TestCase
+    setup do
+      @organization = "OrgOne"
+      @github = app(@organization)
+      @enterprise = app(@organization, domain: 'github.example.com')
+      @rails_env = Rails.env
+      @token_cache_key = "github:integration:#{@organization.downcase}:access-token"
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    teardown do
+      Rails.env = @rails_env
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    test "#domain defaults to github.com" do
+      assert_equal 'github.com', @github.domain
+    end
+
+    test "#url returns the HTTPS url to the github installation" do
+      assert_equal 'https://github.example.com', @enterprise.url
+      assert_equal 'https://github.example.com/foo/bar', @enterprise.url('/foo/bar')
+      assert_equal 'https://github.example.com/foo/bar/baz', @enterprise.url('foo/bar', 'baz')
+    end
+
+    test "#new_client retruns an Octokit::Client configured to use the github installation" do
+      assert_equal 'https://github.example.com/', @enterprise.new_client.web_endpoint
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.new_client.api_endpoint
+    end
+
+    test "#oauth_config.last[:client_options] is nil if domain is not overriden" do
+      assert_nil @github.oauth_config.last[:client_options][:site]
+    end
+
+    test "#oauth_config.last[:client_options] returns Enterprise endpoint if domain is overriden" do
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.oauth_config.last[:client_options][:site]
+    end
+
+    test "#initialize doesn't raise if given an empty config" do
+      assert_nothing_raised do
+        GitHubApp.new(@organization, {})
+      end
+    end
+
+    test "#api_status" do
+      stub_request(:get, "https://www.githubstatus.com/api/v2/components.json").to_return(
+        status: 200,
+        body: %(
+          {
+            "page":{},
+            "components":[
+              {
+                "id":"brv1bkgrwx7q",
+                "name":"API Requests",
+                "status":"operational",
+                "created_at":"2017-01-31T20:01:46.621Z",
+                "updated_at":"2019-07-23T18:41:18.197Z",
+                "position":2,
+                "description":"Requests for GitHub APIs",
+                "showcase":false,
+                "group_id":null,
+                "page_id":"kctbh9vrtdwd",
+                "group":false,
+                "only_show_if_degraded":false
+              }
+            ]
+          }
+        ),
+      )
+      assert_equal "operational", app(@organization).api_status[:status]
+    end
+
+    test "#github token is refreshed after expiration" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        travel 5.minutes
+        assert_equal initial_token, valid_app.token
+
+        travel_to initial_cached_token.expires_at + 5.minutes
+        assert_equal second_token.token, valid_app.token
+      end
+    end
+
+    test "#github token is refreshed in refresh window before expiry" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        # Travel forward, but before the token is refreshed, so the cached value should be the same.
+        travel 40.minutes
+        assert_equal initial_token, valid_app.token
+
+        # Travel to when the token should refresh, but is not expired, which should result in our cache.fetch update block.
+        travel 15.minutes
+        updated_token = valid_app.token
+        assert_not_equal initial_token, updated_token
+
+        cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_operator cached_token.expires_at, :>, initial_cached_token.expires_at
+      end
+    end
+
+    test "#github token is missing refresh_at field" do
+      # $debugging = true
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_cached_token = Shipit::GitHubApp::Token.new("some_initial_github_token", Time.now.utc - 1.minute)
+      initial_cached_token.instance_variable_set(:@refresh_at, nil)
+
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_cached_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        valid_app.instance_variable_set(:@token, initial_cached_token)
+        Rails.cache.write(@token_cache_key, initial_cached_token, expires_in: 1.minute)
+
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
+          .returns(second_token)
+
+        first_token = valid_app.token
+
+        first_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal first_token, first_cached_token.to_s
+
+        travel_to first_cached_token.expires_at + 5.minutes
+        new_token = valid_app.token
+
+        assert_equal second_token.token, new_token
+      end
+    end
+
+    private
+
+    def app(organization, extra_config = {})
+      GitHubApp.new(organization, double_github_app_config.deep_merge(extra_config))
+    end
+
+    def double_github_app_config
+      YAML.load_file('test/dummy/config/secrets_double_github_app.yml')
+    end
+  end
+
+  class GitHubAppsTestOrgTwo < ActiveSupport::TestCase
+    setup do
+      @organization = "OrgTwo"
+      @github = app(@organization)
+      @enterprise = app(@organization, domain: 'github.example.com')
+      @rails_env = Rails.env
+      @token_cache_key = "github:integration:#{@organization.downcase}:access-token"
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    teardown do
+      Rails.env = @rails_env
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    test "#domain defaults to github.com" do
+      assert_equal 'github.com', @github.domain
+    end
+
+    test "#url returns the HTTPS url to the github installation" do
+      assert_equal 'https://github.example.com', @enterprise.url
+      assert_equal 'https://github.example.com/foo/bar', @enterprise.url('/foo/bar')
+      assert_equal 'https://github.example.com/foo/bar/baz', @enterprise.url('foo/bar', 'baz')
+    end
+
+    test "#new_client retruns an Octokit::Client configured to use the github installation" do
+      assert_equal 'https://github.example.com/', @enterprise.new_client.web_endpoint
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.new_client.api_endpoint
+    end
+
+    test "#oauth_config.last[:client_options] is nil if domain is not overriden" do
+      assert_nil @github.oauth_config.last[:client_options][:site]
+    end
+
+    test "#oauth_config.last[:client_options] returns Enterprise endpoint if domain is overriden" do
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.oauth_config.last[:client_options][:site]
+    end
+
+    test "#initialize doesn't raise if given an empty config" do
+      assert_nothing_raised do
+        GitHubApp.new(@organization, {})
+      end
+    end
+
+    test "#api_status" do
+      stub_request(:get, "https://www.githubstatus.com/api/v2/components.json").to_return(
+        status: 200,
+        body: %(
+          {
+            "page":{},
+            "components":[
+              {
+                "id":"brv1bkgrwx7q",
+                "name":"API Requests",
+                "status":"operational",
+                "created_at":"2017-01-31T20:01:46.621Z",
+                "updated_at":"2019-07-23T18:41:18.197Z",
+                "position":2,
+                "description":"Requests for GitHub APIs",
+                "showcase":false,
+                "group_id":null,
+                "page_id":"kctbh9vrtdwd",
+                "group":false,
+                "only_show_if_degraded":false
+              }
+            ]
+          }
+        ),
+      )
+      assert_equal "operational", app(@organization).api_status[:status]
+    end
+
+    test "#github token is refreshed after expiration" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        travel 5.minutes
+        assert_equal initial_token, valid_app.token
+
+        travel_to initial_cached_token.expires_at + 5.minutes
+        assert_equal second_token.token, valid_app.token
+      end
+    end
+
+    test "#github token is refreshed in refresh window before expiry" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        # Travel forward, but before the token is refreshed, so the cached value should be the same.
+        travel 40.minutes
+        assert_equal initial_token, valid_app.token
+
+        # Travel to when the token should refresh, but is not expired, which should result in our cache.fetch update block.
+        travel 15.minutes
+        updated_token = valid_app.token
+        assert_not_equal initial_token, updated_token
+
+        cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_operator cached_token.expires_at, :>, initial_cached_token.expires_at
+      end
+    end
+
+    test "#github token is missing refresh_at field" do
+      # $debugging = true
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_cached_token = Shipit::GitHubApp::Token.new("some_initial_github_token", Time.now.utc - 1.minute)
+      initial_cached_token.instance_variable_set(:@refresh_at, nil)
+
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_cached_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        valid_app.instance_variable_set(:@token, initial_cached_token)
+        Rails.cache.write(@token_cache_key, initial_cached_token, expires_in: 1.minute)
+
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
+          .returns(second_token)
+
+        first_token = valid_app.token
+
+        first_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal first_token, first_cached_token.to_s
+
+        travel_to first_cached_token.expires_at + 5.minutes
+        new_token = valid_app.token
+
+        assert_equal second_token.token, new_token
+      end
+    end
+
+    private
+
+    def app(organization, extra_config = {})
+      GitHubApp.new(organization, double_github_app_config.deep_merge(extra_config))
+    end
+
+    def double_github_app_config
+      YAML.load_file('test/dummy/config/secrets_double_github_app.yml')
+    end
+  end
+end