[Story]: GitHub repository connector v0 (commits, files, issues, PR metadata)

[adoLime]

User Story

As an admin, I want to connect a GitHub repository and ingest its commits, files, issues and PR metadata into the canonical artifact store, so that users can ask the chat about real project history and code context.

Context & Motivation

• Type: Functional
• Parent epic: 03 EPIC - Connectors & Artifact Ingestion #52 (Connectors & Artifact Ingestion)
• Teams: team:backend
• Implementation repo: sprintstart-backend

Dependencies

• Depends on: [Story]: Canonical artifact schema and metadata normalization #161 (canonical artifact schema) — the connector writes into this shape.
• Downstream: [Story]: Indexing pipeline — chunk, embed & store canonical artifacts (source-agnostic) #162 (indexing pipeline) chunks/embeds the artifacts this connector produces — required for the ingested GitHub data to be searchable in chat.
• Relates to: [Story]: Ingestion run history (PM view) #100 (ingestion run history), [Story]: Ingestion status view #101 (ingestion status view)

Acceptance Criteria

• Given an admin provides a repo URL + read-only token, when the connector runs, then it ingests: repository metadata, file tree (text files), commit messages, issues (title/body/labels), and PR metadata (title/body/state) as canonical artifacts.
• Given a configured allowlist of paths/branches, when ingestion runs, then only in-scope content is ingested.
• Given each ingested artifact, when stored, then it carries provenance: e.g. source_system=github, source_url, source_id, content_hash, ingestion_run_id.
• Given a second run with no upstream changes, when executed, then no duplicate artifacts are created (hash-based idempotency).
• Given upstream changes (new commit / edited issue), when re-run, then only changed artifacts are updated.
• Read-only token stored via secret mechanism ([Story]: Keep secrets out of the repo #94/[Story]: GitHub Actions secrets configured for CI #126), never in repo.
• OpenAPI documented; one real repo ingested end-to-end on dev and queryable via chat.

Sub-Tasks

• GitHub API client (REST) with read-only token auth
• Scope/allowlist config (repo, branch)
• Mappers: file / commit / issue / PR -> canonical artifact
• Incremental sync: e.g. track last-synced SHA
• Populate the canonical provenance fields (schema: [Story]: Canonical artifact schema and metadata normalization #161) and write one ingestion_run record per run (read by [Story]: Ingestion run history (PM view) #100)
• Secret wiring ([Story]: Keep secrets out of the repo #94/[Story]: GitHub Actions secrets configured for CI #126)
• OpenAPI annotation + smoke test against a real repo