From 7b0bd0e5b7f9d52a396c5da699bc1c097559d196 Mon Sep 17 00:00:00 2001 From: Madison Date: Tue, 7 Apr 2026 13:43:24 -0700 Subject: [PATCH] =?UTF-8?q?chore:=20bump=20baton-github=20v0.2.12=20?= =?UTF-8?q?=E2=86=92=20v0.2.13?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes enterprise SAML emails not syncing — the enterpriseLicensesAvailable gate in ResourceSyncers() was always false because the SDK calls ResourceSyncers() before Validate(). Enterprises are now always passed through; graceful degradation happens at sync time. Co-Authored-By: Claude Opus 4.6 (1M context) --- go.mod | 2 +- go.sum | 4 ++-- .../baton-github/pkg/connector/connector.go | 23 ++++--------------- vendor/modules.txt | 2 +- 4 files changed, 9 insertions(+), 22 deletions(-) diff --git a/go.mod b/go.mod index d5c551a1..7aae15d2 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/conductorone/baton-github-enterprise go 1.25.2 require ( - github.com/conductorone/baton-github v0.2.12 + github.com/conductorone/baton-github v0.2.13 github.com/conductorone/baton-sdk v0.8.17 github.com/ennyjfrick/ruleguard-logfatal v0.0.2 github.com/quasilyte/go-ruleguard/dsl v0.3.23 diff --git a/go.sum b/go.sum index 35953d57..40b79755 100644 --- a/go.sum +++ b/go.sum @@ -62,8 +62,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= -github.com/conductorone/baton-github v0.2.12 h1:wf585bb02vxoQDI266Pf/nTMYm71nHMce2NBnDQwnuQ= -github.com/conductorone/baton-github v0.2.12/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk= +github.com/conductorone/baton-github v0.2.13 h1:LCnCKo54gr/Z5Nhx6fPQJk0cfXmfv0tImvXJI0Kr0kg= +github.com/conductorone/baton-github v0.2.13/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk= github.com/conductorone/baton-sdk v0.8.17 h1:k++l6LV5uU4wmoP20mWFJcpgpgHCVrqZU/tbJ+sQ1dA= github.com/conductorone/baton-sdk v0.8.17/go.mod h1:agmFrml6APUw4ZlqMEBrnXYj3aAOGKOJ6gztiNj64h0= github.com/conductorone/dpop v0.2.3 h1:s91U3845GHQ6P6FWrdNr2SEOy1ES/jcFs1JtKSl2S+o= diff --git a/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go b/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go index 903adce0..bd7a3940 100644 --- a/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go +++ b/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go @@ -104,22 +104,13 @@ type GitHub struct { syncSecrets bool omitArchivedRepositories bool enterprises []string - enterpriseLicensesAvailable bool // set during Validate; guards enterprise role sync and SAML enrichment } func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.ResourceSyncerV2 { - // Only pass enterprises to builders that need them if the consumed-licenses - // API is confirmed accessible. Otherwise, skip enterprise SAML enrichment - // and enterprise role sync gracefully. - var activeEnterprises []string - if gh.enterpriseLicensesAvailable { - activeEnterprises = gh.enterprises - } - resourceSyncers := []connectorbuilder.ResourceSyncerV2{ orgBuilder(gh.client, gh.appClient, gh.orgCache, gh.orgs, gh.syncSecrets), teamBuilder(gh.client, gh.orgCache), - userBuilder(gh.client, gh.graphqlClient, gh.orgCache, gh.orgs, gh.customClient, activeEnterprises), + userBuilder(gh.client, gh.graphqlClient, gh.orgCache, gh.orgs, gh.customClient, gh.enterprises), repositoryBuilder(gh.client, gh.orgCache, gh.omitArchivedRepositories), orgRoleBuilder(gh.client, gh.orgCache), invitationBuilder(invitationBuilderParams{ @@ -133,8 +124,8 @@ func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.Resour resourceSyncers = append(resourceSyncers, apiTokenBuilder(gh.client, gh.orgCache)) } - if len(activeEnterprises) > 0 { - resourceSyncers = append(resourceSyncers, enterpriseRoleBuilder(gh.client, gh.customClient, activeEnterprises)) + if len(gh.enterprises) > 0 { + resourceSyncers = append(resourceSyncers, enterpriseRoleBuilder(gh.client, gh.customClient, gh.enterprises)) } return resourceSyncers } @@ -221,10 +212,8 @@ func (gh *GitHub) Validate(ctx context.Context) (annotations.Annotations, error) l := ctxzap.Extract(ctx) _, _, err := gh.customClient.ListEnterpriseConsumedLicenses(ctx, gh.enterprises[0], 1) if err != nil { - l.Debug("failed to access enterprise consumed licenses — enterprise SAML email enrichment and enterprise role sync will be skipped", + l.Debug("enterprise consumed licenses API is not accessible — enterprise SAML email enrichment and enterprise role sync may fail at sync time", zap.Error(err)) - } else { - gh.enterpriseLicensesAvailable = true } } return nil, nil @@ -245,11 +234,9 @@ func (gh *GitHub) validateAppCredentials(ctx context.Context) (annotations.Annot l := ctxzap.Extract(ctx) _, _, err := gh.customClient.ListEnterpriseConsumedLicenses(ctx, gh.enterprises[0], 1) if err != nil { - l.Debug("failed to access enterprise consumed licenses — enterprise SAML email enrichment and enterprise role sync will be skipped"+ + l.Debug("enterprise consumed licenses API is not accessible — enterprise SAML email enrichment and enterprise role sync may fail at sync time"+ " (GitHub App installations cannot access this endpoint — use a PAT with enterprise admin scope)", zap.Error(err)) - } else { - gh.enterpriseLicensesAvailable = true } } diff --git a/vendor/modules.txt b/vendor/modules.txt index 8c0bf03e..0139f933 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -162,7 +162,7 @@ github.com/cenkalti/backoff/v5 # github.com/cespare/xxhash/v2 v2.3.0 ## explicit; go 1.11 github.com/cespare/xxhash/v2 -# github.com/conductorone/baton-github v0.2.12 +# github.com/conductorone/baton-github v0.2.13 ## explicit; go 1.25.2 github.com/conductorone/baton-github/pkg/config github.com/conductorone/baton-github/pkg/connector