From f3483002137409d2ecbdcc34251af6ad12d1ce43 Mon Sep 17 00:00:00 2001
From: Carolina Roncaglia
 <102084843+carolinaroncaglia@users.noreply.github.com>
Date: Wed, 27 May 2026 10:54:13 -0300
Subject: [PATCH 1/2] docs: add BATON_DIRECT_COLLABORATORS_ONLY to self-hosted
 PAT env vars table (CXP-579)

---
 docs/connector.mdx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/connector.mdx b/docs/connector.mdx
index f66906d..afc4bb9 100644
--- a/docs/connector.mdx
+++ b/docs/connector.mdx
@@ -313,6 +313,7 @@ baton-github-enterprise
 | `BATON_ORGS` | Comma-separated list of organizations to sync. If not set, all organizations are synced. |
 | `BATON_ENTERPRISES` | Comma-separated list of enterprises to sync enterprise roles for. |
 | `BATON_OMIT_ARCHIVED_REPOSITORIES` | Set to `true` to exclude archived repositories from syncs. |
+| `BATON_DIRECT_COLLABORATORS_ONLY` | Set to `true` to optimize sync for large organizations by reducing API calls (uses grant expansion for team-based repo access and skips per-team detail fetches). |
 | `BATON_PROVISIONING` | Set to `true` to enable provisioning and deprovisioning. |
 | `BATON_SYNC_SECRETS` | Set to `true` to sync secrets (API keys). |
 </Step>
@@ -385,4 +386,4 @@ If you see this error during sync, it most commonly means the GitHub App is miss
 
 This permission is required because the connector queries GitHub's GraphQL API to check whether your organization has SAML/SSO configured. GitHub restricts this data to apps with organization admin read access. Without it, the sync will fail.
 
-**To fix:** Go to your GitHub App settings, then navigate to **Permissions** > **Organization permissions** > **Administration** and set it to **Read-only**.
\ No newline at end of file
+**To fix:** Go to your GitHub App settings, then navigate to **Permissions** > **Organization permissions** > **Administration** and set it to **Read-only**.

From 388498a4f4f1970c00f2d75a3f234194274a6b30 Mon Sep 17 00:00:00 2001
From: Luisina Santos <luisina.santos@conductorone.com>
Date: Thu, 28 May 2026 12:38:56 -0300
Subject: [PATCH 2/2] use ci vars

---
 .github/workflows/ci.yaml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 77fa289..933ecdd 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -5,9 +5,8 @@ jobs:
     runs-on: ubuntu-latest
     env:
       BATON_TOKEN: ${{ secrets.BATON_TOKEN }}
-      BATON_ENTERPRISES: mevans-test
-      BATON_ORGS: mevans-test-org1
-      BATON_INSTANCE_URL: https://github.com
+      BATON_ORGS: ${{ vars.BATON_ORGS }}
+      BATON_INSTANCE_URL: ${{ vars.BATON_INSTANCE_URL }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -21,6 +20,6 @@ jobs:
         uses: ConductorOne/github-workflows/actions/sync-test@v2
         with:
           connector: ./baton-github-enterprise
-          baton-entitlement: 'org_role:8132:assigned'
-          baton-principal: '268751836'
-          baton-principal-type: 'user'
+          baton-entitlement: ${{ vars.ENTITLEMENT_ID }}
+          baton-principal: ${{ vars.PRINCIPAL_ID }}
+          baton-principal-type: ${{ vars.PRINCIPAL_TYPE }}