[erichare]

Adds GitHub.com App installation connections for repository, issue, pull request, and comment actions, plus signed issue and pull request event triggers. Update actions preserve omitted fields. Trigger activation requires public HTTPS ingress and commits a cleanup reservation before remote setup, so a lost response or local rollback can be recovered. Cleanup verifies the recorded callback and blocks replacement until it finishes. Bot events are ignored by default to prevent action loops.

Depends on #15947. This branch includes the shared provider runtime prerequisite. The GitHub bundle, adapter, provider contract, release registration, and regression tests are included.

Verification

Tests ran at source head 9a79fa3f03630547c0881ceda1bea4f04035b72e, using the existing development environment with UV_NO_SYNC=1 and the branch's source paths ahead of installed packages.

• PYTHONPATH=src/backend/base:src/lfx/src:src/bundles/github/src uv run --no-sync pytest src/backend/tests/unit/services/triggers/test_github_provider.py src/backend/tests/unit/services/triggers/test_github_lifecycle.py -q -o log_cli=false --tb=short --show-capture=no passed 63 tests, including uncertain creation, local rollback, owner deletion, in-flight setup, and claimed cleanup.
• PYTHONPATH=src/lfx/src:src/bundles/github/src uv run --no-sync pytest -c src/bundles/github/pyproject.toml src/bundles/github/tests -q --tb=short passed 58 tests with backend imports blocked. PYTHONPATH=src/lfx/src:/private/tmp/le-3196-review-final-wheel-target uv run --no-sync pytest -c src/bundles/github/pyproject.toml src/bundles/github/tests -q --tb=short passed the same 58 tests against the installed wheel.
• From src/frontend, npm test -- --runInBand src/pages/SettingsPage/pages/ConnectionsPage/__tests__/AddConnectionDialog.githubToken.test.tsx passed 1 test. It submits the exact shared credential payload consumed by the backend service test, including required expiration and explicit background consent.
• uv run --no-sync pytest scripts/ci -q -o log_cli=false --tb=short --show-capture=no passed 684 tests with 1 existing skip.
• uv run --no-sync scripts/ci/bundle_release_plan.py plan --base-ref origin/release-1.14.0 --head-ref HEAD --check --output /private/tmp/le3196-final-release-plan.json passed for lfx-github 0.1.0.
• uv lock --check --offline and uv run --no-sync scripts/ci/manage_bundle_profiles.py check passed.
• uv build src/bundles/github --wheel --out-dir /private/tmp/le-3196-review-final-dist succeeded. Installing that wheel in a temporary target discovered all ten components and the owned runtime entry point. Backend-free discovery passed with no backend modules imported.
• Scoped Ruff, Biome, pre-commit checks, and git diff --check passed.

GitHub App repository permissions are enforced by GitHub on each endpoint. PATs and GitHub Enterprise are unsupported. Update nodes preserve empty text fields and do not support clearing them. Manual installation tokens require their actual expiration and expire within one hour. Renewal needs a rotating host resolver or connection recreation and trigger rebinding. Real GitHub installation and live webhook delivery remain unverified. Owner acceptance is pending.

Final review and verification addendum

uv run --no-sync pytest src/bundles/github/tests -q -o addopts= -o cache_dir=/private/tmp/le2477-palette-pytest — 68 passed from source and again against the rebuilt installed wheel. Real palette template construction covers every exported component; previous internal helper imports remain aliases.

uv run --no-sync pytest -q -p no:cacheprovider src/backend/tests/unit/services/triggers/test_github_provider.py src/backend/tests/unit/services/triggers/test_github_lifecycle.py -k 'uncertain or rollback or cleanup or in_progress or superseded or consent or blocked' — 18 passed for uncertain setup, cleanup, ownership, consent, and policy refusal.

The installed nine-provider validation passed 445 backend tests and built all 58 real component templates. The exact aggregate commands and shared-runtime results are recorded in #15947. Independent code, Python, and security review found no unresolved confirmed provider findings.

Source checkpoint: eb2fa49383dc73be224f201eea2dd40792d99fa9. GitHub Actions CI, Mend scan, and PR checks.

Real GitHub App installation and live webhook delivery remain unverified.

Verification after conflict resolution

The final head is 78dbdcebed. It includes the reviewed common changes from 7702a4a514 and the release squash 0b9eaeccdf. Its source tree matches tested merge 37745f8 exactly.

Merge conflicts are resolved. The provider contract entry and implementation were preserved. Shared files retain the reviewed response validation and audit fix, both sets of locale keys, and the approved label exceptions. Shared runtime regression results are recorded separately in #15947.

Provider runtime and lifecycle tests passed 63 tests. The CI script suite passed 716 tests with 1 skip. Backend tests used UV_PROJECT_ENVIRONMENT=/private/tmp/secret-sync-oss-venv, UV_CACHE_DIR=/private/tmp/open-pr-audit-20261023/uv-cache, and PYTHONPATH=src/backend/base:src/lfx/src:src/sdk/src:src/bundles/github/src.

uv run --no-sync pytest src/backend/tests/unit/services/triggers/test_github_provider.py src/backend/tests/unit/services/triggers/test_github_lifecycle.py -q -o addopts= -o log_cli=false -o cache_dir=/private/tmp/open-pr-audit-20261023/github-backend-cache --tb=short --show-capture=no
uv run --no-sync pytest scripts/ci -q -o addopts= -o log_cli=false -o cache_dir=/private/tmp/open-pr-audit-20261023/github-ci-cache --tb=short --show-capture=no

Release planning and bundle profile checks passed. Commit hooks and secret scans passed.

uv run --no-sync scripts/ci/bundle_release_plan.py plan --base-ref 0b9eaeccdf77abf37af994da89d458c82aad24e2 --head-ref HEAD --check --output /private/tmp/open-pr-audit-20261023/github-release-plan.json
uv run --no-sync scripts/ci/manage_bundle_profiles.py check

GitHub reports no merge conflicts against the current release. New CI checks are still running. Live provider acceptance remains unverified.

Summary by CodeRabbit

• New Features
  • Added a GitHub.com preview integration with actions to read, create, and update repositories, issues, pull requests, and comments.
  • Added issue and pull-request triggers for selected repository events.
  • Added support for connecting with a GitHub access token and setting its expiration.
• Improvements
  • Provider access tokens are validated before saving. Token entry can include a required expiration time.
  • Trigger deliveries are verified and deduplicated before being recorded.

[codecov]

Codecov Report

❌ Patch coverage is 90.09901% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.15%. Comparing base (a7ea07b) to head (2ec8876).

Files with missing lines	Patch %	Lines
...flow/services/triggers/providers/github/runtime.py	85.71%	20 Missing ⚠️
src/frontend/src/icons/github/index.tsx	28.57%	5 Missing ⚠️
...gflow/services/triggers/providers/github/config.py	86.20%	4 Missing ⚠️
.../services/triggers/providers/github/credentials.py	96.96%	1 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.14.0   #15957      +/-   ##
==================================================
- Coverage           70.93%   70.15%   -0.79%     
==================================================
  Files                2812     2851      +39     
  Lines              304778   309494    +4716     
  Branches            41311    45267    +3956     
==================================================
+ Hits               216198   217129     +931     
- Misses              86081    89866    +3785     
  Partials             2499     2499              

Flag	Coverage Δ
backend	79.32% <90.70%> (+0.02%)	⬆️
frontend	67.19% <85.29%> (-1.29%)	⬇️
lfx	67.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...gflow/services/triggers/providers/github/events.py	100.00% <100.00%> (ø)
src/frontend/src/icons/github/github.jsx	68.75% <ø> (ø)
...ConnectionsPage/components/AddConnectionDialog.tsx	95.50% <100.00%> (+0.29%)	⬆️
...es/ConnectionsPage/components/SlackTokenFields.tsx	96.62% <100.00%> (+1.14%)	⬆️
...s/ConnectionsPage/hooks/useSlackTokenConnection.ts	100.00% <100.00%> (ø)
src/frontend/src/utils/styleUtils.ts	95.56% <100.00%> (+<0.01%)	⬆️
.../services/triggers/providers/github/credentials.py	96.96% <96.96%> (ø)
...gflow/services/triggers/providers/github/config.py	86.20% <86.20%> (ø)
src/frontend/src/icons/github/index.tsx	50.00% <28.57%> (+50.00%)	⬆️
...flow/services/triggers/providers/github/runtime.py	85.71% <85.71%> (ø)

... and 450 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft