Skip to content

[CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency - #33

Open
sergiocorral-conductorone wants to merge 3 commits into
mainfrom
sergiocorral/cxh-3499-docs-baton-github-enterprise-ghes-ghec
Open

sergiocorral-conductorone wants to merge 3 commits into
mainfrom
sergiocorral/cxh-3499-docs-baton-github-enterprise-ghes-ghec

Conversation

@sergiocorral-conductorone

@sergiocorral-conductorone sergiocorral-conductorone commented Oct 27, 2026 •

Copy link
Copy Markdown

Intent

Docs for CXH-3499 (sub-issue of CXH-3497): make docs/connector.mdx say the connector covers both GHES and GHEC, list what is unique to it, fix the PAT/GitHub App auth inconsistency, state the GHEC instance URL value, and document EMU behavior.

Changes (docs/connector.mdx only)

  • Top note rewritten: covers GHES and GHEC; unique features (GHES support, enterprise roles incl. Enterprise Owner provisioning, licenses, member last activity); choose it when you need those features; links the shared "Choose a GitHub connector" guide.
  • "Gather credentials" intro now says classic PAT or GitHub App (was "classic or fine-grained").
  • Instance URL: GHEC at github.com should enter https://github.com (the default); field marked required (PAT and App tabs). *.ghe.com is not mentioned.
  • Capabilities footnotes: removed the footnote that called organization roles "enterprise licenses"; renumbered the rest in table order.
  • EMU note under account provisioning: invitation fails because accounts are provisioned by the IdP; use the IdP's GitHub SCIM integration; connector still syncs existing EMU users.

Verified in code (vendored baton-github v0.4.8)

  • pkg/config/config.go (instance-url): required, default https://github.com.
  • vendor/.../connector/connector.go:318 and customclient/enterprise_admin.go:34,118: exact https://github.com (trailing slash trimmed) uses the public API; any other value is treated as an enterprise host.
  • connector.go:662-678 (isEnterpriseCloud): github.com / ghe.com are Cloud, anything else is Server; connector.go:~530: Owner role on Server is rejected.
  • invitation.go:248-265 account provisioning = CreateOrgInvitation; invitation.go:290-291 EMU error ("accounts are provisioned by the IdP"), triggered by a 422 matching "managed by an enterprise"/"enterprise managed" (:495).
  • baton_capabilities.json: enterprise_role sync+provision, license sync, invitation account provisioning + delete.
  • connector.go:~283,295: App auth = single org; license sync is PAT-only.
  • Auth groups in config: only personal access token and GitHub app.

Open items

Fixes CXH-3499

🤖 Generated with AI

@linear-code

linear-code Bot commented Oct 27, 2026

Copy link
Copy Markdown

CXH-3499

@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor
Superseded — see the current review report for commit 6e9563e33297

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base a173f77f21f9.
Review mode: full
View review run

Review Summary

This PR only changes docs/connector.mdx. It rewrites the intro tip to say the connector covers GHES and GHEC and lists its unique capabilities. It corrects the auth options to classic PAT or GitHub App (it previously said "fine-grained"). It explains that the Instance URL defaults to https://github.com and is required. It also adds an EMU note to the account-provisioning section.

I scanned the full diff for security and correctness. There are no code, dependency or capability changes. I checked the doc claims against the code:

  • pkg/config/config.go: the instance-url field is required with default https://github.com, and the only auth groups are PAT and GitHub app.
  • Vendored baton-github connector.go:317-320: exact github.com uses the public API.
  • connector.go:529: the Owner role is rejected on Server.
  • invitation.go:291,496: the EMU error text matches the new note.
  • enterprise_role.go: Owner-only provisioning.

The trusted repo-local criteria loaded, but their code-level sections (logging, error wrapping, spans, JSON, provisioning, sync data-loss) don't apply to a docs-only change. Section E (breaking-change gate) and connector-mixin D1–D4 (doc staleness) were checked: the doc stays consistent with config and capabilities, and nothing breaking was introduced. I did not run a docs build or link check.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

  • New (low confidence) docs/connector.mdx:267 (also applies to :286): the Instance URL guidance covers GHEC at github.com but not GHEC with data residency (*.ghe.com). isEnterpriseCloud treats *.ghe.com as Cloud, but any non-github.com value goes through WithEnterpriseURLs, which builds GHES-style /api/v3/ paths. The docs should say whether ghe.com tenants are supported and what value to enter.
Prompt for AI agents
Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around lines 267 and 286: The Instance URL steps only cover GitHub Enterprise Cloud at github.com. Add a sentence for GHEC with data residency (*.ghe.com) saying whether it is supported and which Instance URL value to enter. Check this against vendored baton-github connector.go newGitHubClient, where any value other than https://github.com goes through WithEnterpriseURLs. If ghe.com is not supported, say so explicitly.

Comment thread docs/connector.mdx Resolved
@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor
Superseded — see the current review report for commit b2aff761182a

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base a173f77f21f9.
Review mode: full
View review run

Review Summary

This PR only changes docs/connector.mdx. It rewrites the intro tip to say the connector covers GHES and GHEC and lists its unique capabilities. It corrects the auth options to classic PAT or GitHub App (it previously said "fine-grained"). It explains that the Instance URL defaults to https://github.com and is required. It also adds an EMU note to the account-provisioning section.

I scanned the full diff for security and correctness. There are no code, dependency or capability changes. I checked the doc claims against the code:

  • pkg/config/config.go: the instance-url field is required with default https://github.com, and the only auth groups are PAT and GitHub app.
  • Vendored baton-github connector.go:317-320: exact github.com uses the public API.
  • connector.go:529: the Owner role is rejected on Server.
  • invitation.go:291,496: the EMU error text matches the new note.
  • enterprise_role.go: Owner-only provisioning.

The trusted repo-local criteria loaded, but their code-level sections (logging, error wrapping, spans, JSON, provisioning, sync data-loss) don't apply to a docs-only change. Section E (breaking-change gate) and connector-mixin D1–D4 (doc staleness) were checked: the doc stays consistent with config and capabilities, and nothing breaking was introduced. I did not run a docs build or link check.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

  • New (low confidence) docs/connector.mdx:267 (also applies to :286): the Instance URL guidance covers GHEC at github.com but not GHEC with data residency (*.ghe.com). isEnterpriseCloud treats *.ghe.com as Cloud, but any non-github.com value goes through WithEnterpriseURLs, which builds GHES-style /api/v3/ paths. The docs should say whether ghe.com tenants are supported and what value to enter.
Prompt for AI agents
Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around lines 267 and 286: The Instance URL steps only cover GitHub Enterprise Cloud at github.com. Add a sentence for GHEC with data residency (*.ghe.com) saying whether it is supported and which Instance URL value to enter. Check this against vendored baton-github connector.go newGitHubClient, where any value other than https://github.com goes through WithEnterpriseURLs. If ghe.com is not supported, say so explicitly.

Reviewed commit: 6e9563e33297

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

@github-actions

github-actions Bot commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor
Superseded — see the current review report for commit b2aff761182a

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base a173f77f21f9.
Review mode: incremental since 6e9563e
View review run

Review Summary

This PR only changes docs/connector.mdx. It rewrites the top tip to say the connector covers both GHES and GHEC and lists what is unique to it. It also changes the credentials intro to name a classic PAT or a GitHub App, adds Instance URL guidance for GHEC on github.com, and adds a note on EMU account provisioning. The new commit (b2aff76) adds one sentence to the Instance URL step in both the PAT and GitHub App tabs (docs/connector.mdx:267, :286). The sentence says the instructions cover GHEC on github.com and that GHEC with data residency (*.ghe.com) has not been tested. I scanned the full PR diff for security and correctness issues and found none; there is no code, config, or dependency change. I applied the trusted repo-local criteria and the connector mixin. Docs staleness (D1–D4) is satisfied because the docs file is the change itself. The Sync, Provisioning, Logging, Error, and Breaking-change sections do not apply to a docs-only change. I checked the claims I could against this repo: pkg/config/config.go has the sync-last-activity field, and the capabilities table and footnotes match the new tip. I could not check claims about the separate GitHub connector from this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

  • The previous review's low-confidence suggestion is fixed. It said the Instance URL guidance did not say whether GHEC data residency (*.ghe.com) tenants are supported. docs/connector.mdx:267 and :286 now say explicitly that *.ghe.com has not been tested and that the page makes no support claim, so the docs no longer imply that ghe.com tenants work with the github.com guidance.

@github-actions

github-actions Bot commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor
Superseded — see the current review report for commit 36ccabd38b40

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base a173f77f21f9.
Review mode: incremental since 6e9563e
View review run

Review Summary

This PR only changes docs/connector.mdx. It rewrites the top tip to say the connector covers both GHES and GHEC and lists what is unique to it. It also changes the credentials intro to name a classic PAT or a GitHub App, adds Instance URL guidance for GHEC on github.com, and adds a note on EMU account provisioning. The new commit (b2aff76) adds one sentence to the Instance URL step in both the PAT and GitHub App tabs (docs/connector.mdx:267, :286). The sentence says the instructions cover GHEC on github.com and that GHEC with data residency (*.ghe.com) has not been tested. I scanned the full PR diff for security and correctness issues and found none; there is no code, config, or dependency change. I applied the trusted repo-local criteria and the connector mixin. Docs staleness (D1–D4) is satisfied because the docs file is the change itself. The Sync, Provisioning, Logging, Error, and Breaking-change sections do not apply to a docs-only change. I checked the claims I could against this repo: pkg/config/config.go has the sync-last-activity field, and the capabilities table and footnotes match the new tip. I could not check claims about the separate GitHub connector from this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

  • The previous review's low-confidence suggestion is fixed. It said the Instance URL guidance did not say whether GHEC data residency (*.ghe.com) tenants are supported. docs/connector.mdx:267 and :286 now say explicitly that *.ghe.com has not been tested and that the page makes no support claim, so the docs no longer imply that ghe.com tenants work with the github.com guidance.

Reviewed commit: b2aff761182a

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

@luisina-santos luisina-santos left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Holding this until the shared "Choose a GitHub connector" guide from CXH-3497 exists. That guide isn't written yet, and the parent issue requires all three connector pages to link it.

Once the guide is published, add the link to the note at the top of each page and merge these three PRs together:

Comment thread docs/connector.mdx Resolved
Comment thread docs/connector.mdx Resolved
Comment thread docs/connector.mdx Resolved
Comment thread docs/connector.mdx Resolved
@sergiocorral-conductorone
sergiocorral-conductorone changed the base branch from staging to main November 2, 2026 19:19
… and footnotes

Keep only real differentiators in the top note, state the Instance URL
value for GitHub Enterprise Cloud without the testing caveat, and drop the
footnote that called organization roles enterprise licenses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor
Superseded — see the current review report for commit 36ccabd38b40

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 634dbc764420.
Review mode: full
View review run

Review Summary

This PR only changes docs/connector.mdx. The top Tip now says the connector covers both GHES and GHEC, lists the capabilities only this connector has, and links to a "Choose a GitHub connector" guide. The capabilities footnotes are renumbered, and the misleading line about "org roles = enterprise licenses" is removed. "fine-grained token" is corrected to "GitHub App". The PAT and App tabs now say Instance URL is required and that https://github.com is the GHEC default. An EMU note explains that account provisioning fails for EMU orgs.

I scanned the full PR diff for security and correctness. There is no code, config, or dependency change. I checked the doc claims against the code:

  • The instance-url field is required and defaults to https://github.com (pkg/config/config.go:35-39).
  • The EMU error text matches vendor/.../baton-github/pkg/connector/invitation.go:291, triggered at :496.

From the trusted repo-local criteria, only the documentation-staleness checks (D1–D4) and BP3 apply. The docs now match the config fields, and the auth options match the PAT and GitHub App auth groups. The logging, error-wrapping, sync data-loss, provisioning and breaking-change sections do not apply because no code changed. Gap: I could not check that the new internal link resolves, because the docs site is not in this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

  • New (medium confidence) — docs/connector.mdx:19 links to /baton/choose-github-connector, but the PR body still says this guide "has no real URL yet … No link or placeholder is in the mdx". The PR body also says the Instance URL step notes that *.ghe.com is untested, but the latest commit removed that sentence (:265, :284). Before merging, confirm that the guide is published at that path so the link is not broken. Update the PR description so it matches the final content.
Prompt for AI agents
Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around line 19: The Tip links to `/baton/choose-github-connector`. Confirm that page exists on the published docs site. If it does not exist yet, remove the link or hold the merge until the guide is published. Also update the PR description, which still says the link is pending and that the Instance URL step mentions `*.ghe.com` being untested. That sentence was removed from lines ~265 and ~284.

@github-actions

github-actions Bot commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

Connector PR Review: [CXH-3499] - Docs: baton-github-enterprise — say it covers GHES and GHEC, highlight unique capabilities, fix auth-option inconsistency

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 634dbc764420.
Review mode: full
View review run

Review Summary

This PR only changes docs/connector.mdx. The top Tip now says the connector covers both GHES and GHEC, lists the capabilities only this connector has, and links to a "Choose a GitHub connector" guide. The capabilities footnotes are renumbered, and the misleading line about "org roles = enterprise licenses" is removed. "fine-grained token" is corrected to "GitHub App". The PAT and App tabs now say Instance URL is required and that https://github.com is the GHEC default. An EMU note explains that account provisioning fails for EMU orgs.

I scanned the full PR diff for security and correctness. There is no code, config, or dependency change. I checked the doc claims against the code:

  • The instance-url field is required and defaults to https://github.com (pkg/config/config.go:35-39).
  • The EMU error text matches vendor/.../baton-github/pkg/connector/invitation.go:291, triggered at :496.

From the trusted repo-local criteria, only the documentation-staleness checks (D1–D4) and BP3 apply. The docs now match the config fields, and the auth options match the PAT and GitHub App auth groups. The logging, error-wrapping, sync data-loss, provisioning and breaking-change sections do not apply because no code changed. Gap: I could not check that the new internal link resolves, because the docs site is not in this repo.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

  • New (medium confidence) — docs/connector.mdx:19 links to /baton/choose-github-connector, but the PR body still says this guide "has no real URL yet … No link or placeholder is in the mdx". The PR body also says the Instance URL step notes that *.ghe.com is untested, but the latest commit removed that sentence (:265, :284). Before merging, confirm that the guide is published at that path so the link is not broken. Update the PR description so it matches the final content.
Prompt for AI agents
Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around line 19: The Tip links to `/baton/choose-github-connector`. Confirm that page exists on the published docs site. If it does not exist yet, remove the link or hold the merge until the guide is published. Also update the PR description, which still says the link is pending and that the Instance URL step mentions `*.ghe.com` being untested. That sentence was removed from lines ~265 and ~284.

Reviewed commit: 36ccabd38b40

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants