From 6677033792ed999df506d43c3008cab40cc3d7ee Mon Sep 17 00:00:00 2001 From: Madison Date: Thu, 9 Apr 2026 08:03:45 -0700 Subject: [PATCH] chore: bump baton-github to v0.2.15 Picks up graceful enterprise degradation for GitHub App auth. Co-Authored-By: Claude Opus 4.6 (1M context) --- go.mod | 2 +- go.sum | 4 +-- .../baton-github/pkg/connector/connector.go | 10 ++++--- .../pkg/connector/enterprise_role.go | 26 ++++++++++++++++++- vendor/modules.txt | 2 +- 5 files changed, 35 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 4a90f1fb..55a4e02a 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/conductorone/baton-github-enterprise go 1.25.2 require ( - github.com/conductorone/baton-github v0.2.14 + github.com/conductorone/baton-github v0.2.15 github.com/conductorone/baton-sdk v0.8.18 github.com/ennyjfrick/ruleguard-logfatal v0.0.2 github.com/quasilyte/go-ruleguard/dsl v0.3.23 diff --git a/go.sum b/go.sum index 0c4e221a..d59db0e8 100644 --- a/go.sum +++ b/go.sum @@ -62,8 +62,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= -github.com/conductorone/baton-github v0.2.14 h1:cSOkEE0otWafT9umujg/5jXU4dnXJYDB0ruoDcdWUWU= -github.com/conductorone/baton-github v0.2.14/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk= +github.com/conductorone/baton-github v0.2.15 h1:8TXW9mNa9+wPB5n1ghTXg+4baUEFo3ARlBoPxvyqBoQ= +github.com/conductorone/baton-github v0.2.15/go.mod h1:qyVHJTc78i0iJmoIrCZkTUFENndRnm+3AVvzahX1Vzk= github.com/conductorone/baton-sdk v0.8.18 h1:GvuIVxsnTlg0gdR1hY2qpr68gq49hRxZfIkYOIFqPWY= github.com/conductorone/baton-sdk v0.8.18/go.mod h1:agmFrml6APUw4ZlqMEBrnXYj3aAOGKOJ6gztiNj64h0= github.com/conductorone/dpop v0.2.3 h1:s91U3845GHQ6P6FWrdNr2SEOy1ES/jcFs1JtKSl2S+o= diff --git a/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go b/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go index bd7a3940..9442536b 100644 --- a/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go +++ b/vendor/github.com/conductorone/baton-github/pkg/connector/connector.go @@ -125,7 +125,7 @@ func (gh *GitHub) ResourceSyncers(ctx context.Context) []connectorbuilder.Resour } if len(gh.enterprises) > 0 { - resourceSyncers = append(resourceSyncers, enterpriseRoleBuilder(gh.client, gh.customClient, gh.enterprises)) + resourceSyncers = append(resourceSyncers, enterpriseRoleBuilder(gh.client, gh.appClient, gh.customClient, gh.enterprises)) } return resourceSyncers } @@ -212,7 +212,8 @@ func (gh *GitHub) Validate(ctx context.Context) (annotations.Annotations, error) l := ctxzap.Extract(ctx) _, _, err := gh.customClient.ListEnterpriseConsumedLicenses(ctx, gh.enterprises[0], 1) if err != nil { - l.Debug("enterprise consumed licenses API is not accessible — enterprise SAML email enrichment and enterprise role sync may fail at sync time", + l.Debug("baton-github: enterprise features (--enterprises) require a Personal Access Token with enterprise admin scope. "+ + "The consumed-licenses API is not accessible with the current token.", zap.Error(err)) } } @@ -234,8 +235,9 @@ func (gh *GitHub) validateAppCredentials(ctx context.Context) (annotations.Annot l := ctxzap.Extract(ctx) _, _, err := gh.customClient.ListEnterpriseConsumedLicenses(ctx, gh.enterprises[0], 1) if err != nil { - l.Debug("enterprise consumed licenses API is not accessible — enterprise SAML email enrichment and enterprise role sync may fail at sync time"+ - " (GitHub App installations cannot access this endpoint — use a PAT with enterprise admin scope)", + l.Debug("baton-github: enterprise features (--enterprises) require a Personal Access Token. "+ + "GitHub App authentication cannot access the consumed-licenses API. "+ + "Either switch to PAT auth or remove the --enterprises flag.", zap.Error(err)) } } diff --git a/vendor/github.com/conductorone/baton-github/pkg/connector/enterprise_role.go b/vendor/github.com/conductorone/baton-github/pkg/connector/enterprise_role.go index 51547929..f80be99d 100644 --- a/vendor/github.com/conductorone/baton-github/pkg/connector/enterprise_role.go +++ b/vendor/github.com/conductorone/baton-github/pkg/connector/enterprise_role.go @@ -2,6 +2,7 @@ package connector import ( "context" + "errors" "fmt" "strings" "sync" @@ -12,11 +13,16 @@ import ( "github.com/conductorone/baton-sdk/pkg/types/grant" resourceSdk "github.com/conductorone/baton-sdk/pkg/types/resource" "github.com/google/go-github/v69/github" + "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap" + "go.uber.org/zap" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" ) type enterpriseRoleResourceType struct { resourceType *v2.ResourceType client *github.Client + appClient *github.Client customClient *customclient.Client enterprises []string roleUsersCache map[string][]string @@ -50,6 +56,7 @@ func (o *enterpriseRoleResourceType) getRoleUsersCache(ctx context.Context) (map } func (o *enterpriseRoleResourceType) fillCache(ctx context.Context) error { + l := ctxzap.Extract(ctx) for _, enterprise := range o.enterprises { // GitHub's consumed-licenses API is 1-indexed; page 0 is undocumented // and may return the same results as page 1, causing duplicates. @@ -58,6 +65,14 @@ func (o *enterpriseRoleResourceType) fillCache(ctx context.Context) error { for continuePagination { consumedLicenses, _, err := o.customClient.ListEnterpriseConsumedLicenses(ctx, enterprise, page) if err != nil { + if page == 1 && o.appClient != nil && isPermissionDenied(err) { + l.Debug("baton-github: enterprise features (--enterprises) require a Personal Access Token. "+ + "GitHub App authentication cannot access the consumed-licenses API. "+ + "Either switch to PAT auth or remove the --enterprises flag.", + zap.String("enterprise", enterprise), + zap.Error(err)) + return nil + } return fmt.Errorf("baton-github: error listing enterprise consumed licenses for %s: %w", enterprise, err) } @@ -157,13 +172,22 @@ func (o *enterpriseRoleResourceType) Grants( return ret, &resourceSdk.SyncOpResults{}, nil } -func enterpriseRoleBuilder(client *github.Client, customClient *customclient.Client, enterprises []string) *enterpriseRoleResourceType { +func enterpriseRoleBuilder(client *github.Client, appClient *github.Client, customClient *customclient.Client, enterprises []string) *enterpriseRoleResourceType { return &enterpriseRoleResourceType{ resourceType: resourceTypeEnterpriseRole, client: client, + appClient: appClient, customClient: customClient, enterprises: enterprises, roleUsersCache: make(map[string][]string), mu: &sync.Mutex{}, } } + +func isPermissionDenied(err error) bool { + var grpcErr interface{ GRPCStatus() *status.Status } + if errors.As(err, &grpcErr) { + return grpcErr.GRPCStatus().Code() == codes.PermissionDenied + } + return false +} diff --git a/vendor/modules.txt b/vendor/modules.txt index 71e83ec8..164e57ac 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -162,7 +162,7 @@ github.com/cenkalti/backoff/v5 # github.com/cespare/xxhash/v2 v2.3.0 ## explicit; go 1.11 github.com/cespare/xxhash/v2 -# github.com/conductorone/baton-github v0.2.14 +# github.com/conductorone/baton-github v0.2.15 ## explicit; go 1.25.2 github.com/conductorone/baton-github/pkg/config github.com/conductorone/baton-github/pkg/connector