Add enterprise team membership support - #299
Open
buckelij wants to merge 1 commit into
Open
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1ea2214e-34f7-4e83-b7fd-413b4a534cd6
There was a problem hiding this comment.
Pull request overview
Adds enterprise-team membership synchronization alongside existing organization and team backends.
Changes:
- Adds controller, provider, and REST API service components.
- Supports paginated reads and bulk membership updates.
- Adds configuration documentation and unit tests.
Show a summary per file
| File | Description |
|---|---|
README.md |
Documents enterprise-team configuration. |
lib/entitlements/backend/github_enterprise_team.rb |
Loads the new backend. |
lib/entitlements/backend/github_enterprise_team/controller.rb |
Registers and orchestrates synchronization. |
lib/entitlements/backend/github_enterprise_team/provider.rb |
Caches state and computes differences. |
lib/entitlements/backend/github_enterprise_team/service.rb |
Implements enterprise-team API operations. |
spec/unit/spec_helper.rb |
Loads the backend for tests. |
spec/unit/entitlements/backend/github_enterprise_team/controller_spec.rb |
Tests controller behavior. |
spec/unit/entitlements/backend/github_enterprise_team/provider_spec.rb |
Tests caching, diffs, and commits. |
spec/unit/entitlements/backend/github_enterprise_team/service_spec.rb |
Tests API reads and updates. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 9/9 changed files
- Comments generated: 3
- Review effort level: Balanced
Comment on lines
+133
to
+136
| response = Retryable.with_context(:default) do | ||
| Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) } | ||
| end | ||
| raise APIError.new(response.code.to_i, response.body) unless response.is_a?(Net::HTTPSuccess) |
| type: "github_enterprise_team" | ||
| ``` | ||
|
|
||
| The token must be a classic personal access token with `read:enterprise` and `admin:enterprise` scopes. GitHub App and fine-grained personal access tokens are not supported by the enterprise team membership API. |
Comment on lines
+100
to
+101
| rescue APIError => e | ||
| raise TeamNotFound.new(e.status, e.message) if e.status == 404 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Revenue org wants to ship Copilot plugins to Revenue Hubbers via Copilot enterprise-managed settings https://github.com/github/agent-control-plane/issues/1290. Enterprise-managed settings work by applying policy to members of Enterprise Teams. Entitlements does not appear to currently support syncing to enterprise teams.
This PR adds support for enterprise team sync.
GitHub enterprise teams use a separate REST API from organization teams, so the existing backend cannot manage their membership. This adds a dedicated
github_enterprise_teambackend for synchronizing members of existing Enterprise Cloud teams.The backend reads paginated membership state, computes entitlement differences, and applies additions and removals through the bulk membership endpoints.
Enterprise team creation is intentionally out of scope because the referenced API manages membership only. Authentication requires a classic PAT with
read:enterpriseandadmin:enterprise; GitHub App and fine-grained tokens are not supported by these endpoints. Do we have an existing token configured with those scopes?I ran into some hiccups trying to follow https://github.com/github/entitlements/blob/master/script/dev/README.md (I think these instructions are infrequently used) but I was able to get Copilot to set things up enough to smoke test.