shipit-engine 0.32.0 → 0.35.1

data/test/models/tasks_test.rb

@@ -34,9 +34,9 @@ module Shipit
 
     test "#chunk_output truncates output exceeding the storage limit" do
       task = shipit_tasks(:shipit)
-      task.chunks.delete_all
-      # Dont persist the chunk to the DB, as it may exceed the MySQL max packet size on CI
-      task.chunks.build(text: 'a' * (Task::OUTPUT_SIZE_LIMIT * 1.1))
+      Shipit.redis.del(task.send(:output_key))
+
+      task.write('a' * (Task::OUTPUT_SIZE_LIMIT * 1.1))
 
       output = task.chunk_output
 
@@ -47,5 +47,68 @@ module Shipit
         "'#{Task::OUTPUT_TRUNCATED_MESSAGE.chomp}' was not present in the output",
       )
     end
+
+    test "#retry_if_necessary creates a duplicated task object with pending status and nil created_at and ended_at" do
+      task = shipit_tasks(:shipit)
+      task_stack = task.stack
+      task.retry_if_necessary
+
+      retried_task = task_stack.deploys.last
+
+      assert_not_equal task.id, retried_task.id
+      assert_nil retried_task.started_at
+      assert_nil retried_task.ended_at
+      assert_equal 'pending', retried_task.status
+    end
+
+    test "#retry_if_necessary does not create a new task object if max_retries is nil" do
+      task = shipit_tasks(:shipit2)
+
+      assert_no_difference 'Task.count', 'No new task should be created' do
+        task.retry_if_necessary
+      end
+    end
+
+    test "#retry_if_necessary does not create a new task object if the stack is locked" do
+      task = shipit_tasks(:shipit2)
+      task.stack.lock("test", task.user)
+
+      assert_no_difference 'Task.count', 'No new task should be created' do
+        task.retry_if_necessary
+      end
+    end
+
+    test "#retries_configured? returns true when max_retries is not nil and is greater than zero" do
+      task_with_three_retries = shipit_tasks(:shipit)
+      assert_predicate task_with_three_retries, :retries_configured?
+
+      task_with_nil_retries = shipit_tasks(:shipit2)
+      refute_predicate task_with_nil_retries, :retries_configured?
+
+      task_with_zero_retries = shipit_tasks(:shipit_restart)
+      refute_predicate task_with_zero_retries, :retries_configured?
+    end
+
+    test ".due_for_rollup includes tasks in successful terminal states" do
+      task = shipit_tasks(:shipit)
+      task.update(
+        rolled_up: false,
+        created_at: (60 + 1).minutes.ago.to_s(:db),
+        status: "success",
+      )
+
+      assert_includes Shipit::Task.due_for_rollup, task
+    end
+
+    test ".due_for_rollup includes tasks in unsuccessful terminal states" do
+      task = shipit_tasks(:shipit)
+      task.update(
+        rolled_up: false,
+        created_at: (60 + 1).minutes.ago.to_s(:db),
+        status: "error",
+      )
+
+      assert_includes Shipit::Task.due_for_rollup, task
+    end
   end
 end

data/test/serializers/shipit/pull_request_serializer_test.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module Shipit
+  class PulLRequestSerializerTest < ActiveSupport::TestCase
+    test "structure" do
+      pull_request = shipit_pull_requests(:review_stack_review)
+
+      serialized = serializer.new(pull_request).as_json
+
+      assert_includes serialized.keys, :id
+      assert_includes serialized.keys, :number
+      assert_includes serialized.keys, :title
+      assert_includes serialized.keys, :github_id
+      assert_includes serialized.keys, :additions
+      assert_includes serialized.keys, :deletions
+      assert_includes serialized.keys, :state
+      assert_includes serialized.keys, :html_url
+      assert_includes serialized.keys, :user
+      assert_includes serialized.keys, :assignees
+      assert_includes serialized.keys, :head
+    end
+
+    def serializer
+      Shipit::PullRequestSerializer
+    end
+  end
+end

data/test/test_helper.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 ENV["RAILS_ENV"] ||= "test"
 
+if Warning.respond_to?(:[]=)
+  Warning[:deprecated] = true
+end
+
 require 'simplecov'
 SimpleCov.start('rails') do
   enable_coverage :branch
@@ -32,6 +36,17 @@ begin
 rescue LoadError
 end
 
+# FIXME: We need to get rid of active_model_serializers
+# This is a monkey patch for Ruby 2.7+ compatibility
+module ActionController
+  module SerializationAssertions
+    def process(*, **)
+      @serializers = Hash.new(0)
+      super
+    end
+  end
+end
+
 module ActiveSupport
   class TestCase
     include PayloadsHelper

data/test/unit/anonymous_user_serializer_test.rb

@@ -8,7 +8,7 @@ module Shipit
       serializer = ActiveModel::Serializer.serializer_for(user)
       assert_equal AnonymousUserSerializer, serializer
       serialized = serializer.new(user).to_json
-      assert_json("anonymous", true, document: serialized)
+      assert_json_document(serialized, "anonymous", true)
     end
   end
 end

data/test/unit/command_test.rb

@@ -34,6 +34,11 @@ module Shipit
       ENV['SHIPIT_TEST'] = previous
     end
 
+    test "#env cast to strings except for `nil`" do
+      command = Command.new('echo foo', env: { 'SOME_PATH' => Pathname.new('/foo'), 'HOST' => nil }, chdir: '.')
+      assert_equal({ 'SOME_PATH' => '/foo', 'HOST' => nil }, command.env)
+    end
+
     test "#timeout is 5 minutes by default" do
       command = Command.new('cap $LANG deploy', env: { 'ENVIRONMENT' => 'production' }, chdir: '.')
       assert_equal 5.minutes.to_i, command.timeout
@@ -59,14 +64,14 @@ module Shipit
     end
 
     test "command not found" do
-      error = assert_raises Command::NotFound do
+      error = assert_raises(Command::NotFound) do
         Command.new('does-not-exist foo bar', env: {}, chdir: '.').run
       end
       assert_equal 'does-not-exist: command not found', error.message
     end
 
     test "permission denied" do
-      error = assert_raises Command::Denied do
+      error = assert_raises(Command::Denied) do
         Command.new('/etc/passwd foo bar', env: {}, chdir: '.').run
       end
       assert_equal '/etc/passwd: Permission denied', error.message
@@ -121,7 +126,7 @@ module Shipit
             signalled = true
             break
           end
-          sleep 0.1
+          sleep(0.1)
         end
         signalled
       end

data/test/unit/commit_serializer_test.rb

@@ -10,7 +10,7 @@ module Shipit
       assert_equal CommitSerializer, serializer
       serialized = serializer.new(commit).to_json
 
-      assert_json("author.name", commit.author.name, document: serialized)
+      assert_json_document(serialized, "author.name", commit.author.name)
     end
   end
 end

data/test/unit/deploy_commands_test.rb

@@ -4,8 +4,9 @@ require 'test_helper'
 module Shipit
   class DeployCommandsTest < ActiveSupport::TestCase
     def setup
-      @stack = shipit_stacks(:shipit)
       @deploy = shipit_deploys(:shipit_pending)
+      @stack = @deploy.stack
+      @stack.stubs(:clear_git_cache!)
       @commands = DeployCommands.new(@deploy)
       @deploy_spec = stub(
         dependencies_steps!: ['bundle install --some-args'],
@@ -21,42 +22,97 @@ module Shipit
     end
 
     test "#fetch calls git fetch if repository cache already exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(true)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+
       command = @commands.fetch
+
       assert_equal %w(git fetch origin --tags master), command.args
     end
 
     test "#fetch calls git fetch in git_path directory if repository cache already exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(true)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+
       command = @commands.fetch
-      assert_equal @stack.git_path, command.chdir
+
+      assert_equal @stack.git_path.to_s, command.chdir
     end
 
     test "#fetch calls git clone if repository cache do not exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
+
+      command = @commands.fetch
+
+      expected = %W(git clone --quiet --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args.map(&:to_s)
+    end
+
+    test "#fetch calls git clone if repository cache is empty" do
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(true)
+
       command = @commands.fetch
-      expected = %W(git clone --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+
+      expected = %W(git clone --quiet --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args
+    end
+
+    test "#fetch calls git clone if repository cache corrupt" do
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+      StackCommands.any_instance.expects(:git_cmd_succeeds?)
+        .with(@stack.git_path)
+        .returns(false)
+
+      command = @commands.fetch
+
+      expected = %W(git clone --quiet --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args
+    end
+
+    test "#fetch clears a corrupted git stash before cloning" do
+      @stack.expects(:clear_git_cache!)
+      @stack.git_path.stubs(:exist?).returns(true)
+      @stack.git_path.stubs(:empty?).returns(false)
+      StackCommands.any_instance.expects(:git_cmd_succeeds?)
+        .with(@stack.git_path)
+        .returns(false)
+
+      command = @commands.fetch
+
+      expected = %W(git clone --quiet --single-branch --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
       assert_equal expected, command.args
     end
 
     test "#fetch does not use --single-branch if git is outdated" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
       StackCommands.stubs(git_version: Gem::Version.new('1.7.2.30'))
+
       command = @commands.fetch
-      expected = %W(git clone --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
-      assert_equal expected, command.args
+
+      expected = %W(git clone --quiet --recursive --branch master #{@stack.repo_git_url} #{@stack.git_path})
+      assert_equal expected, command.args.map(&:to_s)
     end
 
     test "#fetch calls git fetch in base_path directory if repository cache do not exist" do
-      Dir.expects(:exist?).with(@stack.git_path).returns(false)
+      @stack.git_path.stubs(:exist?).returns(false)
+
       command = @commands.fetch
-      assert_equal @stack.deploys_path, command.chdir
+
+      assert_equal @stack.deploys_path.to_s, command.chdir
     end
 
     test "#fetch merges Shipit.env in ENVIRONMENT" do
       Shipit.stubs(:env).returns("SPECIFIC_CONFIG" => 5)
       command = @commands.fetch
-      assert_equal 5, command.env["SPECIFIC_CONFIG"]
+      assert_equal '5', command.env["SPECIFIC_CONFIG"]
+    end
+
+    test "#env uses the correct Github token for a stack" do
+      Shipit.github(organization: 'shopify').stubs(:token).returns('aS3cr3Tt0kEn')
+      command = @commands.fetch
+      assert_equal 'aS3cr3Tt0kEn', command.env["GITHUB_TOKEN"]
     end
 
     test "#clone clones the repository cache into the working directory" do
@@ -65,20 +121,20 @@ module Shipit
       clone_args = [
         'git', 'clone', '--quiet',
         '--local', '--origin', 'cache',
-        @stack.git_path, @deploy.working_directory
+        @stack.git_path.to_s, @deploy.working_directory,
       ]
       assert_equal clone_args, commands.first.args
-      assert_equal ['git', 'remote', 'add', 'origin', @stack.repo_git_url], commands.second.args
+      assert_equal ['git', 'remote', 'add', 'origin', @stack.repo_git_url.to_s], commands.second.args
     end
 
     test "#clone clones the repository cache from the deploys_path" do
       commands = @commands.clone
-      assert_equal @stack.deploys_path, commands.first.chdir
+      assert_equal @stack.deploys_path.to_s, commands.first.chdir
     end
 
     test "#checkout checks out the deployed commit" do
       command = @commands.checkout(@deploy.until_commit)
-      assert_equal ['git', 'checkout', @deploy.until_commit.sha], command.args
+      assert_equal ['git', '-c', 'advice.detachedHead=false', 'checkout', @deploy.until_commit.sha], command.args
     end
 
     test "#checkout checks out the deployed commit from the working directory" do
@@ -182,7 +238,7 @@ module Shipit
     test "#install_dependencies merges Shipit.env in ENVIRONMENT" do
       Shipit.stubs(:env).returns("SPECIFIC_CONFIG" => 5)
       command = @commands.install_dependencies.first
-      assert_equal 5, command.env["SPECIFIC_CONFIG"]
+      assert_equal '5', command.env["SPECIFIC_CONFIG"]
     end
 
     test "#install_dependencies merges machine_env in ENVIRONMENT" do

data/test/unit/deploy_serializer_test.rb

@@ -11,7 +11,7 @@ module Shipit
       assert_equal DeploySerializer, serializer
       serialized = serializer.new(deploy).to_json
 
-      assert_json("commits.0.author.name", first_commit_author.name, document: serialized)
+      assert_json_document(serialized, "commits.0.author.name", first_commit_author.name)
     end
   end
 end

data/test/unit/github_app_test.rb

@@ -18,7 +18,7 @@ module Shipit
 
     test "#initialize doesn't raise if given an empty config" do
       assert_nothing_raised do
-        GitHubApp.new({})
+        GitHubApp.new(nil, {})
       end
     end
 
@@ -183,7 +183,6 @@ module Shipit
           .any_instance
           .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
           .returns(second_token)
-
         first_token = valid_app.token
 
         first_cached_token = Rails.cache.fetch(@token_cache_key)
@@ -199,7 +198,7 @@ module Shipit
     private
 
     def app(extra_config = {})
-      GitHubApp.new(default_config.deep_merge(extra_config))
+      GitHubApp.new(nil, default_config.deep_merge(extra_config))
     end
 
     def default_config

data/test/unit/github_apps_test.rb

@@ -0,0 +1,416 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Shipit
+  class GitHubAppsTestOrgOne < ActiveSupport::TestCase
+    setup do
+      @organization = "OrgOne"
+      @github = app(@organization)
+      @enterprise = app(@organization, domain: 'github.example.com')
+      @rails_env = Rails.env
+      @token_cache_key = "github:integration:#{@organization.downcase}:access-token"
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    teardown do
+      Rails.env = @rails_env
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    test "#domain defaults to github.com" do
+      assert_equal 'github.com', @github.domain
+    end
+
+    test "#url returns the HTTPS url to the github installation" do
+      assert_equal 'https://github.example.com', @enterprise.url
+      assert_equal 'https://github.example.com/foo/bar', @enterprise.url('/foo/bar')
+      assert_equal 'https://github.example.com/foo/bar/baz', @enterprise.url('foo/bar', 'baz')
+    end
+
+    test "#new_client retruns an Octokit::Client configured to use the github installation" do
+      assert_equal 'https://github.example.com/', @enterprise.new_client.web_endpoint
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.new_client.api_endpoint
+    end
+
+    test "#oauth_config.last[:client_options] is nil if domain is not overriden" do
+      assert_nil @github.oauth_config.last[:client_options][:site]
+    end
+
+    test "#oauth_config.last[:client_options] returns Enterprise endpoint if domain is overriden" do
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.oauth_config.last[:client_options][:site]
+    end
+
+    test "#initialize doesn't raise if given an empty config" do
+      assert_nothing_raised do
+        GitHubApp.new(@organization, {})
+      end
+    end
+
+    test "#api_status" do
+      stub_request(:get, "https://www.githubstatus.com/api/v2/components.json").to_return(
+        status: 200,
+        body: %(
+          {
+            "page":{},
+            "components":[
+              {
+                "id":"brv1bkgrwx7q",
+                "name":"API Requests",
+                "status":"operational",
+                "created_at":"2017-01-31T20:01:46.621Z",
+                "updated_at":"2019-07-23T18:41:18.197Z",
+                "position":2,
+                "description":"Requests for GitHub APIs",
+                "showcase":false,
+                "group_id":null,
+                "page_id":"kctbh9vrtdwd",
+                "group":false,
+                "only_show_if_degraded":false
+              }
+            ]
+          }
+        ),
+      )
+      assert_equal "operational", app(@organization).api_status[:status]
+    end
+
+    test "#github token is refreshed after expiration" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        travel 5.minutes
+        assert_equal initial_token, valid_app.token
+
+        travel_to initial_cached_token.expires_at + 5.minutes
+        assert_equal second_token.token, valid_app.token
+      end
+    end
+
+    test "#github token is refreshed in refresh window before expiry" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        # Travel forward, but before the token is refreshed, so the cached value should be the same.
+        travel 40.minutes
+        assert_equal initial_token, valid_app.token
+
+        # Travel to when the token should refresh, but is not expired, which should result in our cache.fetch update block.
+        travel 15.minutes
+        updated_token = valid_app.token
+        assert_not_equal initial_token, updated_token
+
+        cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_operator cached_token.expires_at, :>, initial_cached_token.expires_at
+      end
+    end
+
+    test "#github token is missing refresh_at field" do
+      # $debugging = true
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_cached_token = Shipit::GitHubApp::Token.new("some_initial_github_token", Time.now.utc - 1.minute)
+      initial_cached_token.instance_variable_set(:@refresh_at, nil)
+
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_cached_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        valid_app.instance_variable_set(:@token, initial_cached_token)
+        Rails.cache.write(@token_cache_key, initial_cached_token, expires_in: 1.minute)
+
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
+          .returns(second_token)
+
+        first_token = valid_app.token
+
+        first_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal first_token, first_cached_token.to_s
+
+        travel_to first_cached_token.expires_at + 5.minutes
+        new_token = valid_app.token
+
+        assert_equal second_token.token, new_token
+      end
+    end
+
+    private
+
+    def app(organization, extra_config = {})
+      GitHubApp.new(organization, double_github_app_config.deep_merge(extra_config))
+    end
+
+    def double_github_app_config
+      YAML.load_file('test/dummy/config/secrets_double_github_app.yml')
+    end
+  end
+
+  class GitHubAppsTestOrgTwo < ActiveSupport::TestCase
+    setup do
+      @organization = "OrgTwo"
+      @github = app(@organization)
+      @enterprise = app(@organization, domain: 'github.example.com')
+      @rails_env = Rails.env
+      @token_cache_key = "github:integration:#{@organization.downcase}:access-token"
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    teardown do
+      Rails.env = @rails_env
+      Rails.cache.delete(@token_cache_key)
+    end
+
+    test "#domain defaults to github.com" do
+      assert_equal 'github.com', @github.domain
+    end
+
+    test "#url returns the HTTPS url to the github installation" do
+      assert_equal 'https://github.example.com', @enterprise.url
+      assert_equal 'https://github.example.com/foo/bar', @enterprise.url('/foo/bar')
+      assert_equal 'https://github.example.com/foo/bar/baz', @enterprise.url('foo/bar', 'baz')
+    end
+
+    test "#new_client retruns an Octokit::Client configured to use the github installation" do
+      assert_equal 'https://github.example.com/', @enterprise.new_client.web_endpoint
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.new_client.api_endpoint
+    end
+
+    test "#oauth_config.last[:client_options] is nil if domain is not overriden" do
+      assert_nil @github.oauth_config.last[:client_options][:site]
+    end
+
+    test "#oauth_config.last[:client_options] returns Enterprise endpoint if domain is overriden" do
+      assert_equal 'https://github.example.com/api/v3/', @enterprise.oauth_config.last[:client_options][:site]
+    end
+
+    test "#initialize doesn't raise if given an empty config" do
+      assert_nothing_raised do
+        GitHubApp.new(@organization, {})
+      end
+    end
+
+    test "#api_status" do
+      stub_request(:get, "https://www.githubstatus.com/api/v2/components.json").to_return(
+        status: 200,
+        body: %(
+          {
+            "page":{},
+            "components":[
+              {
+                "id":"brv1bkgrwx7q",
+                "name":"API Requests",
+                "status":"operational",
+                "created_at":"2017-01-31T20:01:46.621Z",
+                "updated_at":"2019-07-23T18:41:18.197Z",
+                "position":2,
+                "description":"Requests for GitHub APIs",
+                "showcase":false,
+                "group_id":null,
+                "page_id":"kctbh9vrtdwd",
+                "group":false,
+                "only_show_if_degraded":false
+              }
+            ]
+          }
+        ),
+      )
+      assert_equal "operational", app(@organization).api_status[:status]
+    end
+
+    test "#github token is refreshed after expiration" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        travel 5.minutes
+        assert_equal initial_token, valid_app.token
+
+        travel_to initial_cached_token.expires_at + 5.minutes
+        assert_equal second_token.token, valid_app.token
+      end
+    end
+
+    test "#github token is refreshed in refresh window before expiry" do
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_token = OpenStruct.new(
+        token: "some_initial_github_token",
+        expires_at: Time.now.utc + 60.minutes,
+      )
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).twice.returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).twice.with(config[:installation_id], anything)
+          .returns(initial_token, second_token)
+
+        initial_token = valid_app.token
+        initial_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal initial_token, initial_cached_token.to_s
+
+        # Travel forward, but before the token is refreshed, so the cached value should be the same.
+        travel 40.minutes
+        assert_equal initial_token, valid_app.token
+
+        # Travel to when the token should refresh, but is not expired, which should result in our cache.fetch update block.
+        travel 15.minutes
+        updated_token = valid_app.token
+        assert_not_equal initial_token, updated_token
+
+        cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_operator cached_token.expires_at, :>, initial_cached_token.expires_at
+      end
+    end
+
+    test "#github token is missing refresh_at field" do
+      # $debugging = true
+      Rails.env = 'not_test'
+      config = {
+        app_id: "test_id",
+        installation_id: "test_installation_id",
+        private_key: "test_private_key",
+      }
+      initial_cached_token = Shipit::GitHubApp::Token.new("some_initial_github_token", Time.now.utc - 1.minute)
+      initial_cached_token.instance_variable_set(:@refresh_at, nil)
+
+      second_token = OpenStruct.new(
+        token: "some_new_github_token",
+        expires_at: initial_cached_token.expires_at + 60.minutes,
+      )
+      auth_payload = "test_auth_payload"
+
+      GitHubApp.any_instance.expects(:authentication_payload).returns(auth_payload)
+      valid_app = app(@organization, config)
+
+      freeze_time do
+        valid_app.instance_variable_set(:@token, initial_cached_token)
+        Rails.cache.write(@token_cache_key, initial_cached_token, expires_in: 1.minute)
+
+        Octokit::Client
+          .any_instance
+          .expects(:create_app_installation_access_token).with(config[:installation_id], anything)
+          .returns(second_token)
+
+        first_token = valid_app.token
+
+        first_cached_token = Rails.cache.fetch(@token_cache_key)
+        assert_equal first_token, first_cached_token.to_s
+
+        travel_to first_cached_token.expires_at + 5.minutes
+        new_token = valid_app.token
+
+        assert_equal second_token.token, new_token
+      end
+    end
+
+    private
+
+    def app(organization, extra_config = {})
+      GitHubApp.new(organization, double_github_app_config.deep_merge(extra_config))
+    end
+
+    def double_github_app_config
+      YAML.load_file('test/dummy/config/secrets_double_github_app.yml')
+    end
+  end
+end