[pikann]

Summary

Turns the GitHub plugin from a per-project integration (personal access tokens, a project settings tab, its own PR/branch tables) into the GitHub provider for Paca's platform-neutral Git integration (gitprovider.v1). Paca core now owns repositories, links, identities, change requests, triggers and audit; this plugin only adapts GitHub to the provider SPI. Connections are GitHub Apps only.

Requires core v0.20.0 and Go SDK v0.4.0. Plugin version 0.5.0.

What changed

Added: the provider (backend/spi_*.go, github.go, appjwt.go)

• Identity setup through GitHub's App manifest flow, for the shared identity or one agent's own App. The App's private key, client secret and webhook secret are stored encrypted (AES-256-GCM, ENCRYPTION_KEY).
• Access grants: the App is installed per repository owner when a repository is linked (and right after an agent's App is created), not when the App is created. Installations are discovered lazily; revoked tokens are refreshed; a removed installation is dropped and replaced on reinstall.
• Credentials: short-lived installation tokens narrowed to one repository and to read or write. A requested lifetime is reported as ExpiresAt (GitHub tokens last an hour and can't be shortened).
• Reads and writes: repositories, pull requests (files, diff, review threads), issues, comments, checks and logs (check runs, legacy statuses, Actions job logs), file read, open/update pull requests, comments, thread replies/resolution, batch reviews, labels, reviewers, assignees, merge (with expected head SHA), run status as a check run.
• Branches: look up and create branches (new optional SPI operation, capability branches).
• Webhooks: one App-level webhook per identity; signature verification and normalisation of comments, reviews, pull requests (with their page URL), issues, labels, check runs and pushes into neutral events. Mentions are decided here, so core only sees which identity was addressed.
• The plugin has no routes of its own: core calls the internal /_git/<op> operations. It passes the SDK's conformance suite against a fake GitHub.

Removed (superseded by core)

• The project integration: PAT connection, per-repository webhooks, linked repositories, cached pull requests, task PR/branch links and their routes, automation nodes, the frontend, MCP tools and skills.
• PATs are not supported and no data is migrated from the old tables (a PAT cannot back a provider identity).

Migration 0002_git_provider.sql (one migration for the whole PR) creates the provider's own tables (github_apps, github_app_installations, github_manifest_sessions) and drops the previous release's project-bound tables. Safe to re-run.

Manifest: capabilities: ["git-provider"], no routes/frontend, config keys limited to ENCRYPTION_KEY.

Merge with master

Master's last change (#27, drop unhandled webhook events before the repository lookup) fixed the old per-repository webhook receiver (webhook.go, integration.go), which this branch deletes. The conflicts were resolved by keeping the deletions and this branch's README; nothing from #27 is lost, since deliveries now go through the provider's verify_and_parse_webhook, which verifies the signature and maps only the events Paca uses.

Testing

cd backend
go vet ./... && go test -race ./...
tinygo build -target=wasip1 -buildmode=c-shared -o backend.wasm .

Includes the SDK conformance suite, a fake-GitHub provider test set and migration checks. The migration was also run twice against Postgres 16 with legacy data seeded.

Notes for review

• Upgrading drops the old integration data (see above); admins set up a GitHub App identity and relink repositories in Paca.
• Core must be on v0.20.0 or later (the git-provider capability and /git/* APIs).