Add github integration

.env.example

@@ -41,6 +41,13 @@ GOOGLE_CLIENT_SECRET=
 GH_CLIENT_ID=
 GH_CLIENT_SECRET=
 
+# -----------------------------------------------------------------------------
+# GitHub App Credentials
+# -----------------------------------------------------------------------------
+GH_APP_ID=
+GH_APP_PRIVATE_KEY=
+GH_WEBHOOK_SECRET=
+
 # -----------------------------------------------------------------------------
 # Blob Storage
 # -----------------------------------------------------------------------------

.github/workflows/deploy-preview.yml

@@ -187,6 +187,9 @@ jobs:
           LINEAR_CLIENT_ID: ${{ secrets.LINEAR_CLIENT_ID }}
           LINEAR_CLIENT_SECRET: ${{ secrets.LINEAR_CLIENT_SECRET }}
           LINEAR_WEBHOOK_SECRET: ${{ secrets.LINEAR_WEBHOOK_SECRET }}
+          GH_APP_ID: ${{ secrets.GH_APP_ID }}
+          GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          GH_WEBHOOK_SECRET: ${{ secrets.GH_WEBHOOK_SECRET }}
           QSTASH_TOKEN: ${{ secrets.QSTASH_TOKEN }}
           QSTASH_CURRENT_SIGNING_KEY: ${{ secrets.QSTASH_CURRENT_SIGNING_KEY }}
           QSTASH_NEXT_SIGNING_KEY: ${{ secrets.QSTASH_NEXT_SIGNING_KEY }}
@@ -218,6 +221,9 @@ jobs:
             --env LINEAR_CLIENT_ID=$LINEAR_CLIENT_ID \
             --env LINEAR_CLIENT_SECRET=$LINEAR_CLIENT_SECRET \
             --env LINEAR_WEBHOOK_SECRET=$LINEAR_WEBHOOK_SECRET \
+            --env GH_APP_ID="$GH_APP_ID" \
+            --env GH_APP_PRIVATE_KEY="$GH_APP_PRIVATE_KEY" \
+            --env GH_WEBHOOK_SECRET="$GH_WEBHOOK_SECRET" \
             --env QSTASH_TOKEN=$QSTASH_TOKEN \
             --env QSTASH_CURRENT_SIGNING_KEY=$QSTASH_CURRENT_SIGNING_KEY \
             --env QSTASH_NEXT_SIGNING_KEY=$QSTASH_NEXT_SIGNING_KEY \

.github/workflows/deploy-production.yml

@@ -91,6 +91,9 @@ jobs:
           LINEAR_CLIENT_ID: ${{ secrets.LINEAR_CLIENT_ID }}
           LINEAR_CLIENT_SECRET: ${{ secrets.LINEAR_CLIENT_SECRET }}
           LINEAR_WEBHOOK_SECRET: ${{ secrets.LINEAR_WEBHOOK_SECRET }}
+          GH_APP_ID: ${{ secrets.GH_APP_ID }}
+          GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          GH_WEBHOOK_SECRET: ${{ secrets.GH_WEBHOOK_SECRET }}
           QSTASH_TOKEN: ${{ secrets.QSTASH_TOKEN }}
           QSTASH_CURRENT_SIGNING_KEY: ${{ secrets.QSTASH_CURRENT_SIGNING_KEY }}
           QSTASH_NEXT_SIGNING_KEY: ${{ secrets.QSTASH_NEXT_SIGNING_KEY }}
@@ -122,6 +125,9 @@ jobs:
             --env LINEAR_CLIENT_ID=$LINEAR_CLIENT_ID \
             --env LINEAR_CLIENT_SECRET=$LINEAR_CLIENT_SECRET \
             --env LINEAR_WEBHOOK_SECRET=$LINEAR_WEBHOOK_SECRET \
+            --env GH_APP_ID="$GH_APP_ID" \
+            --env GH_APP_PRIVATE_KEY="$GH_APP_PRIVATE_KEY" \
+            --env GH_WEBHOOK_SECRET="$GH_WEBHOOK_SECRET" \
             --env QSTASH_TOKEN=$QSTASH_TOKEN \
             --env QSTASH_CURRENT_SIGNING_KEY=$QSTASH_CURRENT_SIGNING_KEY \
             --env QSTASH_NEXT_SIGNING_KEY=$QSTASH_NEXT_SIGNING_KEY \

apps/api/package.json

@@ -13,6 +13,9 @@
 	"dependencies": {
 		"@electric-sql/client": "https://pkg.pr.new/@electric-sql/client@3724",
 		"@linear/sdk": "^68.1.0",
+		"@octokit/app": "^16.1.2",
+		"@octokit/rest": "^22.0.1",
+		"@octokit/webhooks": "^14.2.0",
 		"@sentry/nextjs": "^10.32.1",
 		"@superset/auth": "workspace:*",
 		"@superset/db": "workspace:*",

apps/api/src/app/api/github/callback/route.ts

@@ -0,0 +1,152 @@
+import { db } from "@superset/db/client";
+import { githubInstallations, members } from "@superset/db/schema";
+import { Client } from "@upstash/qstash";
+import { and, eq } from "drizzle-orm";
+
+import { env } from "@/env";
+import { verifySignedState } from "@/lib/oauth-state";
+import { githubApp } from "../octokit";
+
+const qstash = new Client({ token: env.QSTASH_TOKEN });
+
+/**
+ * Callback handler for GitHub App installation.
+ * GitHub redirects here after the user installs/configures the app.
+ */
+export async function GET(request: Request) {
+	const url = new URL(request.url);
+	const installationId = url.searchParams.get("installation_id");
+	const setupAction = url.searchParams.get("setup_action");
+	const state = url.searchParams.get("state");
+
+	if (setupAction === "cancel") {
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=installation_cancelled`,
+		);
+	}
+
+	if (!installationId || !state) {
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=missing_params`,
+		);
+	}
+
+	// Verify signed state (prevents forgery)
+	const stateData = verifySignedState(state);
+	if (!stateData) {
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=invalid_state`,
+		);
+	}
+
+	const { organizationId, userId } = stateData;
+
+	// Re-verify membership at callback time (defense-in-depth)
+	const membership = await db.query.members.findFirst({
+		where: and(
+			eq(members.organizationId, organizationId),
+			eq(members.userId, userId),
+		),
+	});
+
+	if (!membership) {
+		console.error("[github/callback] Membership verification failed:", {
+			organizationId,
+			userId,
+		});
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=unauthorized`,
+		);
+	}
+
+	try {
+		const octokit = await githubApp.getInstallationOctokit(
+			Number(installationId),
+		);
+
+		const installationResult = await octokit
+			.request("GET /app/installations/{installation_id}", {
+				installation_id: Number(installationId),
+			})
+			.catch((error: Error) => {
+				console.error("[github/callback] Failed to fetch installation:", error);
+				return null;
+			});
+
+		if (!installationResult) {
+			return Response.redirect(
+				`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=installation_fetch_failed`,
+			);
+		}
+
+		const installation = installationResult.data;
+
+		// Extract account info - account can be User or Enterprise
+		const account = installation.account;
+		const accountLogin =
+			account && "login" in account ? account.login : (account?.name ?? "");
+		const accountType =
+			account && "type" in account ? account.type : "Organization";
+
+		// Save the installation to our database
+		const [savedInstallation] = await db
+			.insert(githubInstallations)
+			.values({
+				organizationId,
+				connectedByUserId: userId,
+				installationId: String(installation.id),
+				accountLogin,
+				accountType,
+				permissions: installation.permissions as Record<string, string>,
+			})
+			.onConflictDoUpdate({
+				target: [githubInstallations.organizationId],
+				set: {
+					connectedByUserId: userId,
+					installationId: String(installation.id),
+					accountLogin,
+					accountType,
+					permissions: installation.permissions as Record<string, string>,
+					suspended: false,
+					suspendedAt: null, // Clear suspension if reinstalling
+					updatedAt: new Date(),
+				},
+			})
+			.returning();
+
+		if (!savedInstallation) {
+			return Response.redirect(
+				`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=save_failed`,
+			);
+		}
+
+		// Queue initial sync job
+		try {
+			await qstash.publishJSON({
+				url: `${env.NEXT_PUBLIC_API_URL}/api/github/jobs/initial-sync`,
+				body: {
+					installationDbId: savedInstallation.id,
+					organizationId,
+				},
+				retries: 3,
+			});
+		} catch (error) {
+			console.error(
+				"[github/callback] Failed to queue initial sync job:",
+				error,
+			);
+			return Response.redirect(
+				`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?warning=sync_queue_failed`,
+			);
+		}
+
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?success=github_installed`,
+		);
+	} catch (error) {
+		console.error("[github/callback] Unexpected error:", error);
+		return Response.redirect(
+			`${env.NEXT_PUBLIC_WEB_URL}/integrations/github?error=unexpected`,
+		);
+	}
+}

apps/api/src/app/api/github/install/route.ts

@@ -0,0 +1,58 @@
+import { auth } from "@superset/auth/server";
+import { db } from "@superset/db/client";
+import { members } from "@superset/db/schema";
+import { and, eq } from "drizzle-orm";
+
+import { env } from "@/env";
+import { createSignedState } from "@/lib/oauth-state";
+
+export async function GET(request: Request) {
+	const session = await auth.api.getSession({ headers: request.headers });
+
+	if (!session?.user) {
+		return Response.json({ error: "Unauthorized" }, { status: 401 });
+	}
+
+	const url = new URL(request.url);
+	const organizationId = url.searchParams.get("organizationId");
+
+	if (!organizationId) {
+		return Response.json(
+			{ error: "Missing organizationId parameter" },
+			{ status: 400 },
+		);
+	}
+
+	const membership = await db.query.members.findFirst({
+		where: and(
+			eq(members.organizationId, organizationId),
+			eq(members.userId, session.user.id),
+		),
+	});
+
+	if (!membership) {
+		return Response.json(
+			{ error: "User is not a member of this organization" },
+			{ status: 403 },
+		);
+	}
+
+	if (!env.GH_APP_ID) {
+		return Response.json(
+			{ error: "GitHub App not configured" },
+			{ status: 500 },
+		);
+	}
+
+	const state = createSignedState({
+		organizationId,
+		userId: session.user.id,
+	});
+
+	const installUrl = new URL(
+		"https://github.com/apps/superset-app/installations/new",
+	);
+	installUrl.searchParams.set("state", state);
+
+	return Response.redirect(installUrl.toString());
+}