[c1-squire-dev]

Summary

GitHub Enterprise audit log sign-ins did not carry an app access target kind. This PR updates baton-github from v0.4.8 to v0.5.6. With this version, GitHub Enterprise audit log sign-ins are marked as app access (TARGET_KIND_APP_ACCESS) on usage events for the usage-app/github resource.

baton-github-enterprise calls baton-github NewLambdaConnector. The usage event feed is therefore inherited, and it stays gated by sync-last-activity. No code change is needed.

Changes

• Update github.com/conductorone/baton-github v0.4.8 to v0.5.6 (Mark usage events as APP_ACCESS baton-github#198).
• Regenerate vendor/. go generate ./pkg/config produced no change.
• .versions.yaml is not edited.

Testing

• go build ./... passes.
• go test ./... passes (no test files in this repo).

🤖 Generated with Claude Code

[linear-code]

CXP-1163

CXP-1343

[github-actions]

Superseded — see the current review report for commit acd380f51c45

Connector PR Review: Update baton-github to v0.5.6

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base e99a47a5df17.
Review mode: full
View review run

Review Summary

This PR changes only dependencies. It bumps baton-github from v0.4.8 to v0.5.6, baton-sdk from v0.44.1 to v0.44.2 and klauspost/compress (indirect) from v1.18.7 to v1.20.2, and regenerates vendor/. There are no first-party code changes.

• What changes at runtime: in the vendored baton-github code, the only change is one line at usage_event_feed.go:323. It sets TargetKind: TARGET_KIND_APP_ACCESS on GitHub audit-log usage events. The SDK side adds the generated UsageEvent.TargetKind proto enum and field (field 5). That field is additive, so the wire format stays compatible.
• PR description: this matches the stated intent.
• Coverage: I scanned the full diff for security and correctness, including go.mod, go.sum, vendor/modules.txt and the vendored conductorone sources. I checked that the go.sum and modules.txt entries match go.mod.
• Not reviewed: I did not read the klauspost/compress vendored assembly and Go changes line by line. That is a third-party compression library, pulled in transitively by the SDK.
• Trusted criteria (data-loss rules S/R7, log levels, spans, JSON types, breaking-change gate): I applied them to the changed connector surface. No resource-producing List/Entitlements/Grants path, provisioning code, resource type, entitlement or config field changed. The usage-event change is an additive enum on the event feed, which stays gated by sync-last-activity. So none of B1–B9 or S1–S6 applies.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (low confidence): the PR description doesn't mention that baton-sdk v0.44.2 also adds a check-update CLI subcommand to every connector built on it.
  • Where: vendor/github.com/conductorone/baton-sdk/pkg/config/config.go:69 registers the command (cmd.AddCommand(cli.NewCheckUpdateCommand(...))); vendor/github.com/conductorone/baton-sdk/pkg/cli/check_update.go implements it.
  • What it does: when someone runs it, it makes an outbound HTTP GET to https://dist.conductorone.com, with a 5s timeout. It only runs on explicit invocation and is not in any sync path, so the risk is low.
  • Upstream nit: the vendored pkg/sdk/version.go constant still says v0.44.1 in the v0.44.2 module. That's an SDK-side issue, not something to fix here.

[github-actions]

Superseded — see the current review report for commit aa572448c946

Connector PR Review: Update baton-github to v0.5.6

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base e99a47a5df17.
Review mode: full
View review run

Review Summary

This PR changes only dependencies. It bumps baton-github from v0.4.8 to v0.5.6, baton-sdk from v0.44.1 to v0.44.2 and klauspost/compress (indirect) from v1.18.7 to v1.20.2, and regenerates vendor/. There are no first-party code changes.

• What changes at runtime: in the vendored baton-github code, the only change is one line at usage_event_feed.go:323. It sets TargetKind: TARGET_KIND_APP_ACCESS on GitHub audit-log usage events. The SDK side adds the generated UsageEvent.TargetKind proto enum and field (field 5). That field is additive, so the wire format stays compatible.
• PR description: this matches the stated intent.
• Coverage: I scanned the full diff for security and correctness, including go.mod, go.sum, vendor/modules.txt and the vendored conductorone sources. I checked that the go.sum and modules.txt entries match go.mod.
• Not reviewed: I did not read the klauspost/compress vendored assembly and Go changes line by line. That is a third-party compression library, pulled in transitively by the SDK.
• Trusted criteria (data-loss rules S/R7, log levels, spans, JSON types, breaking-change gate): I applied them to the changed connector surface. No resource-producing List/Entitlements/Grants path, provisioning code, resource type, entitlement or config field changed. The usage-event change is an additive enum on the event feed, which stays gated by sync-last-activity. So none of B1–B9 or S1–S6 applies.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (low confidence): the PR description doesn't mention that baton-sdk v0.44.2 also adds a check-update CLI subcommand to every connector built on it.
  • Where: vendor/github.com/conductorone/baton-sdk/pkg/config/config.go:69 registers the command (cmd.AddCommand(cli.NewCheckUpdateCommand(...))); vendor/github.com/conductorone/baton-sdk/pkg/cli/check_update.go implements it.
  • What it does: when someone runs it, it makes an outbound HTTP GET to https://dist.conductorone.com, with a 5s timeout. It only runs on explicit invocation and is not in any sync path, so the risk is low.
  • Upstream nit: the vendored pkg/sdk/version.go constant still says v0.44.1 in the v0.44.2 module. That's an SDK-side issue, not something to fix here.

---

Reviewed commit: acd380f51c45

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit aa572448c946

Connector PR Review: Update baton-github to v0.5.6

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 555c36158094.
Review mode: full
View review run

Review Summary

This PR moves github.com/conductorone/baton-github from v0.4.8 to v0.5.6. It updates go.mod, go.sum, vendor/modules.txt and the vendored sources. baton-sdk stays at v0.44.2: that bump is already on main, so the SDK notes from the earlier review no longer apply to this diff.

The one runtime change is a single line in the vendored usage_event_feed.go:323. It sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on usage events built from GitHub audit-log entries. That constant exists in the vendored SDK (event_feed.pb.go:89), and the field is additive. This matches the PR description.

I scanned the full PR diff (all 4 files) for security and correctness. The go.sum hashes and the modules.txt entry (## explicit; go 1.27.3) are consistent with go.mod. No module was added, removed, replaced or excluded.

I applied the trusted repo-local criteria to this change:

• No List/Entitlements/Grants path changed, so the S1–S6 and R7 data-loss rules do not apply.
• No provisioning code changed, so P/PR do not apply.
• No resource type, entitlement slug, ID derivation or config field changed, so B1–B9 and BP do not apply.
• No new logging, spans or JSON response structs, so A, C and D do not apply.

The usage feed is still gated by sync-last-activity.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

Connector PR Review: Update baton-github to v0.5.6

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 555c36158094.
Review mode: full
View review run

Review Summary

This PR moves github.com/conductorone/baton-github from v0.4.8 to v0.5.6. It updates go.mod, go.sum, vendor/modules.txt and the vendored sources. baton-sdk stays at v0.44.2: that bump is already on main, so the SDK notes from the earlier review no longer apply to this diff.

The one runtime change is a single line in the vendored usage_event_feed.go:323. It sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on usage events built from GitHub audit-log entries. That constant exists in the vendored SDK (event_feed.pb.go:89), and the field is additive. This matches the PR description.

I scanned the full PR diff (all 4 files) for security and correctness. The go.sum hashes and the modules.txt entry (## explicit; go 1.27.3) are consistent with go.mod. No module was added, removed, replaced or excluded.

I applied the trusted repo-local criteria to this change:

• No List/Entitlements/Grants path changed, so the S1–S6 and R7 data-loss rules do not apply.
• No provisioning code changed, so P/PR do not apply.
• No resource type, entitlement slug, ID derivation or config field changed, so B1–B9 and BP do not apply.
• No new logging, spans or JSON response structs, so A, C and D do not apply.

The usage feed is still gated by sync-last-activity.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

---

Reviewed commit: aa572448c946

[github-actions]

No blocking issues found — see the full review report