fix: remove enterpriseLicensesAvailable gate from ResourceSyncers

[madison-c-evans]

Summary

• Remove enterpriseLicensesAvailable gate from ResourceSyncers() — it was always false because the SDK calls ResourceSyncers() during newBuilder() initialization, before Validate() runs
• Enterprises are now always passed through to builders; graceful degradation happens at sync time in fetchAndStoreEnterpriseSAML

What went wrong

During end-to-end validation on the sandbox, SAML emails were missing. Debug logs showed checkOrgSAML hitting samlStateDisabled ("no SAML identity provider found for org, disabling SAML enrichment") because len(u.enterprises) == 0 — the enterprises slice was empty despite being configured. Root cause: ResourceSyncers() was gating on a flag set in Validate(), but the SDK calls ResourceSyncers() first.

Test plan

• Verified locally with go mod replace pointing baton-github-enterprise at this fix
• SAML emails now sync correctly (3 users with enterprise SAML emails populated)
• go build and go test pass

🤖 Generated with Claude Code

[linear]

CXH-1180 GitHub: Support syncing emails when SAML is configured at Enterprise level

[github-actions]

Claude finished @madison-c-evans's task in 56s —— View job

---

PR Review: fix: remove enterpriseLicensesAvailable gate from ResourceSyncers

• Gather context and read changed files
• Analyze the fix and its correctness
• Post review feedback

---

Verdict: Looks good ✅

This is a clean, well-scoped fix for a real ordering bug. The analysis is correct:

The bug: ResourceSyncers() is called by the SDK during newBuilder() initialization, which runs before Validate(). The enterpriseLicensesAvailable flag was only set in Validate(), so it was always false when ResourceSyncers() ran. This meant enterprises was always passed as an empty slice, so enterprise role sync and SAML enrichment never activated.

The fix: Remove the dead gate entirely and pass gh.enterprises directly. This is the right approach because:

1. Graceful degradation already exists at sync time — fetchAndStoreEnterpriseSAML (pkg/connector/user.go:154-162) catches API errors, logs them as debug, and falls back to samlStateDisabled. So the consumed-licenses check in Validate() was redundant protection.

2. The Validate() probe is kept as a warning — the debug log at lines 215-216 and 237-239 now warns that "enterprise SAML email enrichment and enterprise role sync may fail at sync time" rather than claiming to gate anything. This gives operators a heads-up without incorrectly suppressing functionality.

3. No leftover references to the removed field — enterpriseLicensesAvailable is fully excised (struct field, both Validate branches, and the ResourceSyncers conditional).

One minor observation: The Validate() probe still makes an API call to ListEnterpriseConsumedLicenses purely for a debug log. This is fine as a diagnostic signal, but if you ever want to simplify further, it could be removed since the real error handling happens in fetchAndStoreEnterpriseSAML. Not suggesting a change here — just noting it.

No issues found. Ship it.

[madison-c-evans]

Email loading issue still seen when I tried validation. The SDK calls ResourceSyncers() during connector initialization, before Validate() ever runs. The enterpriseLicensesAvailable flag was set in Validate(), so it was always false when ResourceSyncers() checked it, meaning enterprises were never passed to the user builder. That's why checkOrgSAML saw an empty enterprises list and disabled SAML enrichment. The fix: skip the gate entirely in ResourceSyncers() and always pass enterprises through - graceful degradation already happens at sync time in fetchAndStoreEnterpriseSAML