chore(github): Validate the same org is installing

src/sentry/integrations/github/integration.py

@@ -929,7 +929,14 @@ def dispatch(self, request: HttpRequest, pipeline: Pipeline) -> HttpResponseBase
                 if chosen_installation_id == "-1":
                     return pipeline.next_step()
 
-                if not has_scm_multi_org:
+                # Validate the same org is installing and that they have the multi org feature
+                installing_organization_slug = pipeline.fetch_state("installing_organization_slug")
+                is_same_installing_org = (
+                    (installing_organization_slug is not None)
+                    and installing_organization_slug
+                    == self.active_user_organization.organization.slug
+                )
+                if not has_scm_multi_org or not is_same_installing_org:
                     lifecycle.record_failure(GitHubInstallationError.FEATURE_NOT_AVAILABLE)
                     return error(
                         request,
@@ -954,7 +961,9 @@ def dispatch(self, request: HttpRequest, pipeline: Pipeline) -> HttpResponseBase
 
                 pipeline.bind_state("chosen_installation", chosen_installation_id)
                 return pipeline.next_step()
-
+            pipeline.bind_state(
+                "installing_organization_slug", self.active_user_organization.organization.slug
+            )
             serialized_organization = organization_service.serialize_organization(
                 id=self.active_user_organization.organization.id,
                 as_user=(

tests/sentry/integrations/github/test_integration.py

@@ -1736,3 +1736,58 @@ def test_github_installation_filters_valid_installations(self):
                 "avatar_url": "https://github.com/knobiknows/all-the-bufo/raw/main/all-the-bufo/bufo-pog.png",
             },
         ]
+
+    @with_feature("organizations:integrations-scm-multi-org")
+    @with_feature("organizations:github-multi-org")
+    @responses.activate
+    @patch("sentry.integrations.utils.metrics.EventLifecycle.record_event")
+    def test_github_installation_validates_installing_organization(self, mock_record):
+        self._setup_with_existing_installations()
+        chosen_installation_id = "1"
+
+        # Initiate the OAuthView
+        resp = self.client.get(self.init_path)
+        assert resp.status_code == 302
+        redirect = urlparse(resp["Location"])
+        assert redirect.scheme == "https"
+        assert redirect.netloc == "github.com"
+        assert redirect.path == "/login/oauth/authorize"
+        assert (
+            redirect.query
+            == f"client_id=github-client-id&state={self.pipeline.signature}&redirect_uri=http://testserver/extensions/github/setup/"
+        )
+
+        # We just got resp. from GH, continue with OAuthView -> GithubOrganizationSelection
+        resp = self.client.get(
+            "{}?{}".format(
+                self.setup_path,
+                urlencode({"code": "12345678901234567890", "state": self.pipeline.signature}),
+            )
+        )
+        assert resp.status_code == 200
+
+        # Create a new organization and switch to it
+        self.create_organization(name="new-org", owner=self.user)
+        self.login_as(self.user)
+
+        # Try to continue the installation with the new organization
+        resp = self.client.get(
+            "{}?{}".format(
+                self.setup_path,
+                urlencode(
+                    {
+                        "code": "12345678901234567890",
+                        "state": self.pipeline.signature,
+                        "chosen_installation_id": chosen_installation_id,
+                    }
+                ),
+            )
+        )
+
+        self.assertTemplateUsed(resp, "sentry/integrations/github-integration-failed.html")
+        assert (
+            b'{"success":false,"data":{"error":"Your organization does not have access to this feature."}}'
+            in resp.content
+        )
+        assert b'window.opener.postMessage({"success":false' in resp.content
+        assert_failure_metric(mock_record, GitHubInstallationError.FEATURE_NOT_AVAILABLE)