Mark usage events as APP_ACCESS by c1-squire-dev[bot] · Pull Request #198 · ConductorOne/baton-github

c1-squire-dev · 2026-11-09T20:05:13Z

Summary

Sign-in usage events from the GitHub audit log target a synthetic resource, usage-app/github. That resource stands in for GitHub itself. Without a target kind, consumers read the target as a child app.

This PR sets target_kind = TARGET_KIND_APP_ACCESS on every usage event. The field comes from baton-sdk v0.44.2 (ConductorOne/baton-sdk#1224), which main already uses.

Changes

Set TargetKind to TARGET_KIND_APP_ACCESS in usageEventFromAuditEntry.
Assert the target kind in TestUsageEventFromAuditEntry.

Testing

go build ./... passes.
go test ./... passes.
golangci-lint was not run. The installed binary is built with Go 1.26 and the repo targets Go 1.27.3.

🤖 Generated with Claude Code

linear-code · 2026-11-09T20:05:21Z

CXP-1163

CXP-1339

github-actions · 2026-11-09T20:05:30Z

Superseded — see the current review report for commit 0a03d360a1c7

Connector PR Review: Mark usage events as APP_ACCESS

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base beaa4a2063a7.
Review mode: full
View review run

Review Summary

The change sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on the usage event built in usageEventFromAuditEntry (pkg/connector/usage_event_feed.go:323). That function is the only place the connector builds a UsageEvent, so every usage event now carries the field. The test asserts the new value. The PR also bumps baton-sdk from v0.44.1 to v0.44.2 and klauspost/compress from v1.18.7 to v1.20.2 as an indirect dependency, and re-vendors both.

I scanned the full PR diff for security and correctness issues. In go.mod and go.sum, each changed module matches the code change: the SDK bump adds the UsageEvent_TargetKind enum, and the vendored validator has no rules for the field, so the new value passes validation. The SDK bump also adds a user-invoked check-update CLI subcommand (vendor/.../pkg/cli/check_update.go). It makes a single HTTP GET to the registry with a 5s timeout, and only when someone explicitly runs it. It doesn't change sync behavior. I also noticed that the vendored sdk.Version constant reads v0.44.1 in v0.44.2. That comes from upstream and is cosmetic, so it isn't a finding against this repo.

I applied the repo-local criteria, and none of their sections are triggered: the PR has no logging, error wrapping, spans, JSON response structs, provisioning, resource IDs, or sync result paths. The change only adds a field to an outbound event, which is additive and not a B1–B9 breaking change. Coverage gap: I reviewed the vendored klauspost/compress source (about 42k diff lines of upstream compression code) only for dependency and release impact, not line by line.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

github-actions · 2026-11-09T20:06:33Z

Superseded — see the current review report for commit 73fe36fde848

Connector PR Review: Mark usage events as APP_ACCESS

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base beaa4a2063a7.
Review mode: full
View review run

Review Summary

The change sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on the usage event built in usageEventFromAuditEntry (pkg/connector/usage_event_feed.go:323). That function is the only place the connector builds a UsageEvent, so every usage event now carries the field. The test asserts the new value. The PR also bumps baton-sdk from v0.44.1 to v0.44.2 and klauspost/compress from v1.18.7 to v1.20.2 as an indirect dependency, and re-vendors both.

I scanned the full PR diff for security and correctness issues. In go.mod and go.sum, each changed module matches the code change: the SDK bump adds the UsageEvent_TargetKind enum, and the vendored validator has no rules for the field, so the new value passes validation. The SDK bump also adds a user-invoked check-update CLI subcommand (vendor/.../pkg/cli/check_update.go). It makes a single HTTP GET to the registry with a 5s timeout, and only when someone explicitly runs it. It doesn't change sync behavior. I also noticed that the vendored sdk.Version constant reads v0.44.1 in v0.44.2. That comes from upstream and is cosmetic, so it isn't a finding against this repo.

I applied the repo-local criteria, and none of their sections are triggered: the PR has no logging, error wrapping, spans, JSON response structs, provisioning, resource IDs, or sync result paths. The change only adds a field to an outbound event, which is additive and not a B1–B9 breaking change. Coverage gap: I reviewed the vendored klauspost/compress source (about 42k diff lines of upstream compression code) only for dependency and release impact, not line by line.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Reviewed commit: 0a03d360a1c7

github-actions

No blocking issues found — see the full review report

Usage events target the synthetic usage-app/github resource. That resource stands in for GitHub itself. Each event is a sign-in to GitHub as a whole. Set target_kind to TARGET_KIND_APP_ACCESS so consumers treat the target as the app. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-09T21:16:21Z

Superseded — see the current review report for commit 73fe36fde848

Connector PR Review: Mark usage events as APP_ACCESS

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base d8bf928eac77.
Review mode: full
View review run

Review Summary

This PR sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on the one v2.UsageEvent built in the repo, in usageEventFromAuditEntry (pkg/connector/usage_event_feed.go:323). That makes it apply to every usage event the GitHub audit-log feed emits. The PR also adds a test assertion for the new field (usage_event_feed_test.go:110).

I scanned the full PR diff (2 files) for security and correctness issues. The enum exists in the vendored baton-sdk (vendor/.../pb/c1/connector/v2/event_feed.pb.go:89), and the struct-literal field is valid for the default (non-opaque) generated API.

I applied the repo-local criteria: log levels (A), error wrapping (B), JSON typing (D), the breaking-change gate (E) and sync data-loss rules (S). None of them apply here. The change adds a field to emitted events and does not touch logging, error paths, IDs, entitlements, or resource-producing methods. It is not a breaking change under B1–B9.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

New (low): The PR description doesn't match the diff. It says the PR bumps baton-sdk to v0.44.2, moves klauspost/compress to v1.20.2, and re-vendors. The diff doesn't touch go.mod, go.sum or vendor/, because the base branch already pins github.com/conductorone/baton-sdk v0.44.2 (go.mod:6) and klauspost/compress v1.20.2 (go.mod:82). Update the description so reviewers and release notes don't attribute the dependency bump to this PR.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In the PR description (no file change):
- The "Changes" section says the PR updates baton-sdk to v0.44.2, moves klauspost/compress to v1.20.2, and re-vendors. The PR diff only touches pkg/connector/usage_event_feed.go and pkg/connector/usage_event_feed_test.go; the base branch's go.mod already pins both versions. Remove or reword the dependency-bump bullet so it says the PR depends on the SDK version already on main.

github-actions · 2026-11-09T21:17:22Z

Connector PR Review: Mark usage events as APP_ACCESS

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base d8bf928eac77.
Review mode: full
View review run

Review Summary

This PR sets TargetKind: v2.UsageEvent_TARGET_KIND_APP_ACCESS on the one v2.UsageEvent built in the repo, in usageEventFromAuditEntry (pkg/connector/usage_event_feed.go:323). That makes it apply to every usage event the GitHub audit-log feed emits. The PR also adds a test assertion for the new field (usage_event_feed_test.go:110).

I scanned the full PR diff (2 files) for security and correctness issues. The enum exists in the vendored baton-sdk (vendor/.../pb/c1/connector/v2/event_feed.pb.go:89), and the struct-literal field is valid for the default (non-opaque) generated API.

I applied the repo-local criteria: log levels (A), error wrapping (B), JSON typing (D), the breaking-change gate (E) and sync data-loss rules (S). None of them apply here. The change adds a field to emitted events and does not touch logging, error paths, IDs, entitlements, or resource-producing methods. It is not a breaking change under B1–B9.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

New (low): The PR description doesn't match the diff. It says the PR bumps baton-sdk to v0.44.2, moves klauspost/compress to v1.20.2, and re-vendors. The diff doesn't touch go.mod, go.sum or vendor/, because the base branch already pins github.com/conductorone/baton-sdk v0.44.2 (go.mod:6) and klauspost/compress v1.20.2 (go.mod:82). Update the description so reviewers and release notes don't attribute the dependency bump to this PR.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In the PR description (no file change):
- The "Changes" section says the PR updates baton-sdk to v0.44.2, moves klauspost/compress to v1.20.2, and re-vendors. The PR diff only touches pkg/connector/usage_event_feed.go and pkg/connector/usage_event_feed_test.go; the base branch's go.mod already pins both versions. Remove or reword the dependency-bump bullet so it says the PR depends on the SDK version already on main.

Reviewed commit: 73fe36fde848

github-actions

No blocking issues found — see the full review report

github-actions Bot reviewed Nov 9, 2026

View reviewed changes

c1-squire-dev Bot force-pushed the john.allers/CXP-1163/usage-event-target-kind branch from 0a03d36 to 73fe36f Compare November 9, 2026 21:16

github-actions Bot reviewed Nov 9, 2026

View reviewed changes

johnallers marked this pull request as ready for review November 9, 2026 21:35

johnallers requested a review from a team November 9, 2026 21:35

johnallers approved these changes Nov 9, 2026

View reviewed changes

johnallers merged commit de2dcfb into main Nov 9, 2026
9 checks passed

c1-squire-dev Bot mentioned this pull request Nov 9, 2026

Update baton-github to v0.5.6 ConductorOne/baton-github-enterprise#34

Merged

Conversation

c1-squire-dev Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Uh oh!

linear-code Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector PR Review: Mark usage events as APP_ACCESS

Review Summary

Security Issues

Correctness Issues

Suggestions

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector PR Review: Mark usage events as APP_ACCESS

Review Summary

Security Issues

Correctness Issues

Suggestions

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector PR Review: Mark usage events as APP_ACCESS

Review Summary

Security Issues

Correctness Issues

Suggestions

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector PR Review: Mark usage events as APP_ACCESS

Review Summary

Security Issues

Correctness Issues

Suggestions

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

c1-squire-dev Bot commented Nov 9, 2026 •

edited

Loading

linear-code Bot commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading