Track whether GitHub App is installed on org (#2947)

Ref stacklok/epics#280

cmd/dev/app/container/cmd_verify.go

@@ -125,6 +125,7 @@ func buildGitHubClient(token string) (provifv1.GitHub, error) {
 			}`),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential(token),
 		&serverconfig.ProviderConfig{},
 	)

cmd/dev/app/rule_type/rttst.go

@@ -169,6 +169,7 @@ func testCmdRun(cmd *cobra.Command, _ []string) error {
 			}`),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential(token),
 		&serverconfig.ProviderConfig{
 			GitHubApp: &serverconfig.GitHubAppConfig{

database/migrations/000048_installation_metadata.down.sql

@@ -0,0 +1,19 @@
+-- Copyright 2024 Stacklok, Inc
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--      http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+BEGIN;
+
+ALTER TABLE provider_github_app_installations DROP COLUMN is_org;
+
+COMMIT;

database/migrations/000048_installation_metadata.up.sql

@@ -0,0 +1,19 @@
+-- Copyright 2024 Stacklok, Inc
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--      http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+BEGIN;
+
+ALTER TABLE provider_github_app_installations ADD COLUMN is_org BOOLEAN NOT NULL DEFAULT FALSE;
+
+COMMIT;

database/query/provider_github_app_installations.sql

@@ -6,15 +6,16 @@ SELECT * FROM provider_github_app_installations WHERE app_installation_id = $1;
 
 -- name: UpsertInstallationID :one
 INSERT INTO provider_github_app_installations
-    (organization_id, app_installation_id, provider_id, enrolling_user_id, enrollment_nonce, project_id)
-VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (organization_id)
+    (organization_id, app_installation_id, provider_id, enrolling_user_id, enrollment_nonce, project_id, is_org)
+VALUES ($1, $2, $3, $4, $5, $6, $7) ON CONFLICT (organization_id)
     DO
 UPDATE SET
     app_installation_id = $2,
     provider_id = $3,
     enrolling_user_id = $4,
     enrollment_nonce = $5,
     project_id = $6,
+    is_org = $7,
     updated_at = NOW()
 WHERE provider_github_app_installations.organization_id = $1
     RETURNING *;

internal/controlplane/handlers_githubwebhooks.go

@@ -634,8 +634,7 @@ func gatherArtifactInfo(
 	}
 
 	// we also need to fill in the visibility which is not in the payload
-	isOrg := client.GetOwner() != ""
-	ghArtifact, err := client.GetPackageByName(ctx, isOrg, artifact.Owner, string(verifyif.ArtifactTypeContainer), artifact.Name)
+	ghArtifact, err := client.GetPackageByName(ctx, artifact.Owner, string(verifyif.ArtifactTypeContainer), artifact.Name)
 	if err != nil {
 		return nil, fmt.Errorf("error extracting artifact from repo: %w", err)
 	}
@@ -691,9 +690,8 @@ func updateArtifactVersionFromRegistry(
 ) error {
 	// we'll grab the artifact version from the REST endpoint because we need the visibility
 	// and createdAt fields which are not in the payload
-	isOrg := client.GetOwner() != ""
-	ghVersion, err := client.GetPackageVersionById(ctx, isOrg,
-		artifactOwnerLogin, string(verifyif.ArtifactTypeContainer), artifactName, version.VersionId)
+	ghVersion, err := client.GetPackageVersionById(ctx, artifactOwnerLogin, string(verifyif.ArtifactTypeContainer),
+		artifactName, version.VersionId)
 	if err != nil {
 		return fmt.Errorf("error getting package version from repository: %w", err)
 	}

internal/controlplane/handlers_githubwebhooks_test.go

@@ -258,7 +258,7 @@ func (s *UnitTestSuite) TestHandleWebHookRepository() {
 		ID:             1,
 		ProjectID:      projectID,
 		Provider:       providerName,
-	}, nil).Times(2)
+	}, nil)
 
 	mockStore.EXPECT().
 		GetRepositoryByRepoID(gomock.Any(), gomock.Any()).

internal/engine/actions/remediate/gh_branch_protect/gh_branch_protect_test.go

@@ -68,6 +68,7 @@ func testGithubProviderBuilder(baseURL string) *providers.ProviderBuilder {
 			Definition: json.RawMessage(definitionJSON),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)

internal/engine/actions/remediate/pull_request/pull_request_test.go

@@ -106,6 +106,7 @@ func testGithubProviderBuilder() *providers.ProviderBuilder {
 			Definition: json.RawMessage(definitionJSON),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)

internal/engine/actions/remediate/remediate_test.go

@@ -52,6 +52,7 @@ var (
 }`),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)

internal/engine/actions/remediate/rest/rest_test.go

@@ -58,6 +58,7 @@ var (
 }`),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)
@@ -74,6 +75,7 @@ var (
 }`),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)
@@ -99,6 +101,7 @@ func testGithubProviderBuilder(baseURL string) *providers.ProviderBuilder {
 			Definition: json.RawMessage(definitionJSON),
 		},
 		sql.NullString{},
+		false,
 		credentials.NewGitHubTokenCredential("token"),
 		&serverconfig.ProviderConfig{},
 	)

internal/engine/executor_test.go

@@ -130,7 +130,7 @@ func TestExecutor_handleEntityEvent(t *testing.T) {
 			}).
 		Return(db.ProviderAccessToken{
 			EncryptedToken: authtoken,
-		}, nil).Times(2)
+		}, nil)
 
 	// list one profile
 	crs := []*minderv1.Profile_Rule{

internal/engine/ingester/artifact/artifact.go

@@ -246,8 +246,7 @@ func getAndFilterArtifactVersions(
 	}
 
 	// Fetch all available versions of the artifact
-	isOrg := (ghCli.GetOwner() != "")
-	upstreamVersions, err := ghCli.GetPackageVersions(ctx, isOrg, artifact.Owner, artifact.GetTypeLower(), artifact.GetName())
+	upstreamVersions, err := ghCli.GetPackageVersions(ctx, artifact.Owner, artifact.GetTypeLower(), artifact.GetName())
 	if err != nil {
 		return nil, fmt.Errorf("error retrieving artifact versions: %w", err)
 	}