Add GitHub source authorization connector - #97
Conversation
|
Warning Review limit reached
Next review available in: 32 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (16)
📝 WalkthroughWalkthroughAdds a GitHub App connector with authenticated REST access, repository scope discovery, issue and pull-request crawling, ACL and membership modeling, Spring registration, administration UI metadata, fixtures, and integration coverage. ChangesGitHub connector
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Admin
participant GitHubCredentialProbe
participant GitHubConnectorBatchSource
participant GitHubApiClient
participant ConnectorCrawlBatch
Admin->>GitHubCredentialProbe: submit GitHub App credential
GitHubCredentialProbe->>GitHubApiClient: validate installation and repositories
GitHubConnectorBatchSource->>GitHubApiClient: crawl repositories, collaborators, and issues
GitHubApiClient-->>GitHubConnectorBatchSource: paginated GitHub data
GitHubConnectorBatchSource->>ConnectorCrawlBatch: emit content, ACL, and membership state
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 16
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.java`:
- Around line 212-219: The requestUri method should build URLs without adding
the pagination parameter, since it is also used by single-object requests such
as installation(). Move the default per_page insertion into collectPaged so only
paginated collection requests receive PAGE_SIZE, and update affected
expectations accordingly.
- Around line 155-186: Update the retry logic in GitHubApiClient.get so
installation-token refresh is allowed once whenever a 401 is received,
regardless of the current attempt number. Track whether the token has already
been refreshed, use that state in the 401 condition, and preserve the existing
invalidate/accessToken flow while preventing repeated refreshes.
- Around line 161-169: Add a cause-accepting constructor to GitHubApiException
that delegates the message and ResourceAccessException cause to the superclass
while setting errorCode. Update the MAX_ATTEMPTS branch in GitHubApiClient to
use this constructor and pass the caught dropped exception, preserving the
existing message and "unreachable" code.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.java`:
- Around line 69-81: Update readPrivateKey to handle GitHub’s -----BEGIN RSA
PRIVATE KEY----- PKCS#1 format: strip its headers, parse the PKCS#1 DER, wrap it
as PrivateKeyInfo, and then build the RSA private key while preserving existing
PKCS#8 support. If PKCS#1 support is not implemented, detect that header before
decoding and throw GitHubCredentialException with an actionable conversion
instruction instead of the generic invalid-key message.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.java`:
- Around line 391-399: The duplicated errorCodeOf logic should be centralized to
keep GitHub refusal reasons consistent. In
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.java:391-399,
remove the private helper and use a shared package-private mapper such as
GitHubErrorCodes.of(failure); make the same change in
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialProbe.java:97-105,
removing its private helper and routing calls through the shared mapper.
- Around line 251-264: Move the byId map construction and population in
repositoriesInScope below the settings.repositoryIds().isEmpty() early-return
branch, so the enumerate-everything path only filters and sorts installed
repositories without building an unused index.
- Around line 122-132: Remove the duplicate installation account-id validation
and its outdated comment from the post-contentCrawl block in
GitHubConnectorBatchSource. In requireInstallation, preserve the existing
connection_mismatch check and move the rationale about validating the
installation before token exchange there. Update the caller to invoke
requireInstallation(client, configuration) for its side effect without retaining
an unused installation local.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCrawlSettings.java`:
- Around line 27-52: Update GitHubCrawlSettings.from() to distinguish null/blank
input, which must retain defaults() and all-repositories behavior, from nonblank
explicit configuration. For malformed JSON, non-object roots, or a present
repositoryIds array containing no valid admissible IDs, return a fail-closed
settings value that yields no repositories in repositoriesInScope(), while
preserving valid IDs and existing handling for valid configurations.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.java`:
- Around line 83-90: Update the installation-token exchange flow in
GitHubInstallationTokenSource to enforce MAX_BODY_BYTES before JSON decoding,
matching the bounded read used by the API client. Detect responses exceeding the
limit and map them to invalid_installation, while preserving normal parsing of
token and deadline fields.
- Around line 91-94: Update the exception handling in
GitHubInstallationTokenSource so RestClientException and transport failures from
RestClient.retrieve() are classified and propagated using their original error
category and retryable behavior. Reserve invalid_installation for
credential/token decode failures or empty-token results, and avoid converting
transient API failures through the broad RuntimeException catch.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubScopeBrowser.java`:
- Around line 73-82: Update GitHubScopeBrowser.instruction to explicitly check
the repository’s has_issues value and return the existing “Enable Issues”
message only when issues are disabled; replace the unconditional fallback with a
neutral message for repositories rejected due to invalid or missing id, name, or
owner.login.
In
`@integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubApiClientTests.java`:
- Around line 58-72: Update the GitHub API client JWT test around
source.appJwt() to expose or reuse the fixture’s public key and
cryptographically verify the JWT’s third segment with SHA256withRSA over the
encoded header and claims segments. Keep the existing structure and claim
assertions, but make the test fail when the signature is corrupted or generated
from different bytes.
In
`@integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java`:
- Around line 26-28: Update the ApplicationContextRunner in
GitHubConnectorAutoConfigurationTests to discover auto-configuration through the
published AutoConfiguration.imports resource instead of directly supplying
GitHubConnectorAutoConfiguration.class. Preserve CollaboratorConfiguration and
assert the connector configuration is loaded through normal discovery.
In
`@integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.java`:
- Line 49: Remove the unused REPOSITORY_ID constant from
GitHubConnectorBatchSourceTests and update the MockRestRequestMatchers.header
usage near the affected request assertions to use the file’s existing
static-import style instead of a fully qualified reference.
- Around line 237-248: The GitHub connector tests lack coverage for the
installation-identity validation in requireInstallation. Add test cases using
expectInstallation or equivalent fixtures that assert mismatched account.id
produces connection_mismatch and missing Issues permission produces
issues_read_required, while preserving the existing valid-installation coverage.
In `@web/src/features/admin/connector-catalog.ts`:
- Around line 149-150: Update GitHubAppKey.parse() to accept GitHub’s downloaded
PKCS#1 “RSA PRIVATE KEY” PEM format alongside the existing PKCS#8 format. Align
the credential examples in web/src/features/admin/connector-catalog.ts:149-150
and web/src/features/admin/connector-probe.ts:36-37 with the accepted
downloaded-key format, and update any related fixtures or validation messaging
accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d4483ac2-554b-4ec8-b6cc-6e2fd1aa9ed2
⛔ Files ignored due to path filters (5)
docs/increments/completed/2026-07-28-github-authorization-connector/design.mdis excluded by!docs/**docs/increments/completed/2026-07-28-github-authorization-connector/plan.mdis excluded by!docs/**docs/roadmap.mdis excluded by!docs/**docs/specs/domains/knowledge-ingestion.mdis excluded by!docs/**docs/tests/domains/knowledge-ingestion.mdis excluded by!docs/**
📒 Files selected for processing (27)
ARCHITECTURE.mdapps/worker/src/main/java/com/orgmemory/worker/connector/FileConnectorBatchSource.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/connector/FileConnectorBatchSourceTests.javademo/fixtures/connector/github-01-initial-crawl.jsondemo/fixtures/connector/github-02-recrawl-membership.jsonintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiException.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCrawlSettings.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialException.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialProbe.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubScopeBrowser.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSourceProfile.javaintegrations/connectors/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubApiClientTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubTestCredential.javaweb/src/features/admin/components/source-icon.tsxweb/src/features/admin/connector-catalog.tsweb/src/features/admin/connector-forms.tsweb/src/features/admin/connector-github.test.tsweb/src/features/admin/connector-probe.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (4)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Record current behavior in architecture/specification documentation only after it exists in code; keep intended behavior in vision, roadmap, or an active increment, and do not duplicate state.
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult current official documentation via Context7 and the projectorgmemory-*verification skills.
Before retrieval, AI, MCP, permission, upload, graph, or export work, readdocs/guidelines/agent-safety.md.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant verification gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Files:
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSourceProfile.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialException.javademo/fixtures/connector/github-02-recrawl-membership.jsonweb/src/features/admin/connector-probe.tsintegrations/connectors/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubApiClientTests.javaweb/src/features/admin/connector-catalog.tsintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaweb/src/features/admin/connector-forms.tsintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.javaweb/src/features/admin/connector-github.test.tsintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiException.javademo/fixtures/connector/github-01-initial-crawl.jsonintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCrawlSettings.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubTestCredential.javaapps/worker/src/main/java/com/orgmemory/worker/connector/FileConnectorBatchSource.javaapps/worker/src/test/java/com/orgmemory/worker/connector/FileConnectorBatchSourceTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubScopeBrowser.javaARCHITECTURE.mdweb/src/features/admin/components/source-icon.tsxintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialProbe.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.java
**/*.{java,kt}
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a verification gate for the Java backend.
Files:
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSourceProfile.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialException.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubApiClientTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiException.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCrawlSettings.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubTestCredential.javaapps/worker/src/main/java/com/orgmemory/worker/connector/FileConnectorBatchSource.javaapps/worker/src/test/java/com/orgmemory/worker/connector/FileConnectorBatchSourceTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubScopeBrowser.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialProbe.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.java
**/*.{ts,tsx,js,jsx,css,scss,html}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, run Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters; do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration.
Files:
web/src/features/admin/connector-probe.tsweb/src/features/admin/connector-catalog.tsweb/src/features/admin/connector-forms.tsweb/src/features/admin/connector-github.test.tsweb/src/features/admin/components/source-icon.tsx
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/features/admin/connector-probe.tsweb/src/features/admin/connector-catalog.tsweb/src/features/admin/connector-forms.tsweb/src/features/admin/connector-github.test.tsweb/src/features/admin/components/source-icon.tsx
🧠 Learnings (2)
📚 Learning: 2026-07-23T03:36:09.053Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 16
File: web/src/features/admin/components/admin-mappings-page.tsx:190-211
Timestamp: 2026-07-23T03:36:09.053Z
Learning: In the OrgMemory admin UI, preserve the principal display ordering returned by the backend instead of re-sorting on the client. The server-owned order (e.g., unmapped views first, then deterministic ordering by source-system, connection, kind, and external-key as defined in SourcePrincipalAdminService#listPrincipals) must be used as-is to avoid mismatches with the server’s intended admin mappings/principals list.
Applied to files:
web/src/features/admin/components/source-icon.tsx
📚 Learning: 2026-07-27T19:32:49.877Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 96
File: integrations/connectors/src/main/java/com/orgmemory/connectors/slack/SlackConnectorBatchSource.java:0-0
Timestamp: 2026-07-27T19:32:49.877Z
Learning: When reviewing connector component checkpointing completeness logic, ensure it clearly distinguishes authorization-evidence gaps from intentional content-scope limits. Authorization evidence gaps mean the connector cannot validate required permissions/membership for the source and should mark the relevant permission/membership component(s) as incomplete; intentional content-scope limits (e.g., configured channel subset filters or bounded thread history) should not be treated as authorization gaps. For Slack sources specifically: if permission and membership data are incomplete for the Slack access gap, mark the permission/membership component incomplete; do not downgrade completeness solely due to configured channel subsets or bounded thread history. For Google Drive: if sharing is unreadable (e.g., insufficient access to view sharing metadata), mark the permission component incomplete.
Applied to files:
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.java
🪛 ast-grep (0.44.1)
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.java
[error] 188-198: Potential Server-Side Request Forgery (SSRF): an HTTP client request (RestTemplate, WebClient, java.net.http.HttpClient, or URI.create) is built directly from request-controlled input such as getParameter/getHeader/ getQueryString. An attacker can redirect the outbound request to internal services or cloud metadata endpoints. Validate the URL against an allowlist of permitted hosts and schemes before issuing the request.
Context: restClient
.get()
.uri(URI.create(uri))
.header(HttpHeaders.ACCEPT, "application/vnd.github+json")
.header(HttpHeaders.AUTHORIZATION, "Bearer " + bearer)
.header("X-GitHub-Api-Version", GitHubInstallationTokenSource.API_VERSION)
.exchange((request, response) -> new Response(
response.getStatusCode(),
response.getHeaders(),
new String(readBounded(response.getBody()), StandardCharsets.UTF_8)),
false)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(ssrf-http-client-tainted-url-java)
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.java
[warning] 252-252: Avoid LDAP injections
Context: retrieval.search(actor, query, 10, "req-" + userId + "-" + query.hashCode())
Note: [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Security best practice.
(ldap-injection-java)
🪛 PMD (7.26.0)
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.java
[Medium] 39-40: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unreadable' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 78-79: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unusable' on all code paths
(PreserveStackTrace (Best Practices))
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.java
[Medium] 92-93: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'refused' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 114-115: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unusable' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 129-131: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unreadable' on all code paths
(PreserveStackTrace (Best Practices))
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.java
[Medium] 163-165: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'dropped' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 206-208: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unreadable' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 295-297: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'invalid' on all code paths
(PreserveStackTrace (Best Practices))
[Medium] 326-328: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'interrupted' on all code paths
(PreserveStackTrace (Best Practices))
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.java
[Medium] 49-49: UnusedPrivateField (Best Practices): Avoid unused private fields such as 'REPOSITORY_ID'.
(UnusedPrivateField (Best Practices))
🔇 Additional comments (24)
demo/fixtures/connector/github-01-initial-crawl.json (1)
1-81: LGTM!demo/fixtures/connector/github-02-recrawl-membership.json (1)
1-63: LGTM!apps/worker/src/test/java/com/orgmemory/worker/connector/FileConnectorBatchSourceTests.java (2)
24-33: LGTM!Also applies to: 36-48
34-34: 📐 Maintainability & Code QualityNo change needed for
List.getFirst().The project’s Java convention plugin targets Java 25, so this call is compatible.
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.java (2)
208-246: 📐 Maintainability & Code QualityRun the mandated Java verification gates.
No clean-gate results are supplied for this PostgreSQL-backed access-revocation scenario. Run the terminating clean test and JetBrains inspection specified by the test harness before merge. As per coding guidelines, “JetBrains IDE inspection is a verification gate for the Java backend” and “use a terminating clean test as the context gate.”
Source: Coding guidelines
247-255: LGTM!Also applies to: 339-442
apps/worker/src/main/java/com/orgmemory/worker/connector/FileConnectorBatchSource.java (1)
19-20: LGTM!ARCHITECTURE.md (1)
123-124: LGTM!Also applies to: 353-353
web/src/features/admin/components/source-icon.tsx (1)
1-1: LGTM!Also applies to: 76-83
web/src/features/admin/connector-catalog.ts (1)
147-154: 🗄️ Data Integrity & IntegrationVerify the GitHub App permission contract.
This descriptor promises issue and pull-request crawling but requests only
Metadata: readandIssues: read. GitHub lists the pull-request endpoints under the separatePull requestsrepository permission; if the backend uses those endpoints, installations from this UI will receive 403s for PRs. Confirm the endpoint contract, or addPull requests: readand update the assertion inweb/src/features/admin/connector-github.test.tsLines 14-17. (docs.github.com)web/src/features/admin/connector-forms.ts (1)
124-128: 🎯 Functional CorrectnessEnforce the numeric minimum at the configuration boundary.
min: 1is declared here, butconfigFromstill parses arbitrary draft text without checking finiteness, integrality, or the minimum. If submit handling does not reject0, negative values, decimals, and non-numeric input first, invalid crawl limits can reach the adapter. Verify that validation path and add boundary tests.integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiClient.java (1)
40-45: LGTM!Also applies to: 116-153, 221-250, 252-330
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubApiException.java (1)
4-20: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubAppKey.java (1)
34-55: LGTM!Also applies to: 83-88
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialException.java (1)
4-16: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubScopeBrowser.java (1)
40-71: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCredentialProbe.java (1)
38-51: LGTM!Also applies to: 53-95
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorBatchSource.java (1)
178-198: Completeness modelling matches the connector contract.An unreadable collaborators response marks PERMISSION and MEMBERSHIP incomplete with
GITHUB_COLLABORATORS_NOT_FULLY_READand never collapses the audience to an empty ACL, while a configuredmaxItemsPerRepositorybound marks only CONTENT incomplete — authorization-evidence gaps and intentional content-scope limits stay distinct. Based on learnings that connector checkpointing must distinguish authorization-evidence gaps from intentional content-scope limits.Also applies to: 289-337, 426-577
Source: Learnings
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorBatchSourceTests.java (1)
72-235: LGTM!Also applies to: 278-351
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.java (1)
23-142: 📐 Maintainability & Code QualityRun the required Java inspection gate before merge.
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubInstallationTokenSource.java#L23-L142: inspect the token-exchange implementation.integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubCrawlSettings.java#L15-L62: inspect configuration parsing.integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubApiClientTests.java#L33-L173: inspect transport tests.integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubTestCredential.java#L11-L42: inspect test credential generation.integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSourceProfile.java#L8-L24: inspect source profile defaults.integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java#L14-L39: inspect Spring bean registration.integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java#L24-L67: inspect auto-configuration tests.As per coding guidelines, “JetBrains IDE inspection is a verification gate for the Java backend.”
Source: Coding guidelines
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubTestCredential.java (1)
10-40: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSourceProfile.java (1)
7-23: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java (1)
13-38: LGTM!integrations/connectors/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports (1)
3-3: LGTM!
1 participant
What changed
repository:{id}:readerssource group populated from GitHub's fully paginated effective collaboratorsWhy
The source-authorization kernel must work beyond Slack channel membership and Drive per-file ACLs. GitHub supplies an effective entitlement set that includes direct, team-derived, organization, owner, and enterprise access paths; mirroring that set avoids rebuilding an incomplete second GitHub authorization engine.
Security and operator impact
https://api.github.combefore an installation token is forwardedMetadata: readandIssues: readpermissionsValidation
./gradlew.bat --no-daemon :integrations:connectors:cleanTest :integrations:connectors:test --rerun-tasks./gradlew.bat --no-daemon :apps:worker:test./gradlew.bat --no-daemon clean testcorepack pnpm -C web test:unit -- connector-github.test.tscorepack pnpm -C web typecheckcorepack pnpm -C web buildgit diff --checkJetBrains inspection was attempted for each edited Java file but was unavailable because the attached IDE had a different repository open; the full compile/test fallback passed.
Summary by CodeRabbit
New Features
Documentation