---
id: w2/m11/t003
title: "Fix the projector to mint an installation token / spec.cloneSecret when a row's repo matches a workspace GitHub connection"
worker: worker2
status: todo
estimate: 45m
depends_on: [w2/m11/t001]
---

## Objective

Close the private-repo build failure for store-managed apps: the rows→CR projector never mints a clone secret, so private-repo builds fail with `could not read Username for 'https://github.com'`.

## Context

- `lego/backend/internal/store/reconciler.go` (`projectSpec`) — where the CR gets built from a store row.
- `lego/backend/internal/apps/` `Service.ensureCloneSecret` — the existing clone-token seam on the public path; reuse its logic rather than duplicating it.
- `lego/backend/internal/github/` — installation-token minting.

## Steps

1. In `projectSpec`, when a row's repo matches a workspace's connected GitHub installation, call the same installation-token minting used by `ensureCloneSecret` and set `spec.cloneSecret` on the projected CR.
2. Handle the token-refresh case (installation tokens are 1h-lived) — confirm the projector re-runs on a cadence that keeps this fresh, or document the constraint if not.
3. Ensure public repos and image-based creates are unaffected (no clone secret needed).

## Files

- `lego/backend/internal/store/reconciler.go`
- `lego/backend/internal/apps/` (reuse `ensureCloneSecret`'s token-minting logic)

## Acceptance criteria

- [ ] A store-managed app with a private repo gets a valid `spec.cloneSecret` and its build succeeds.
- [ ] Public repos and image-based store-managed apps are unaffected.

## Out of scope

- Changing the 1h token TTL behavior itself — that's GitHub App's own constraint (`docs/ADR026-github-integration.md`).
