[CXH-2123] - Add provisioning for the Enterprise Owner role - GitHub Connector

README.md

@@ -42,7 +42,11 @@ baton resources
 - Users
 - Teams
 - Repositories
+- Organization roles
+- Invitations (users invited to an organization who have not accepted yet)
 - GitHub Apps (installed in organizations, synced as non-human identities)
+- Enterprise roles, only when `--enterprises` is set. A personal access token syncs every role; a GitHub App syncs the built-in Enterprise Owner role and can also grant and revoke it, with the app installed on both the enterprise account and the organization
+- Enterprise licenses, only when `--enterprises` is set and the connector authenticates with a personal access token. The API behind them is not available to GitHub Apps, so the type is not registered on the app path
 
 By default, `baton-github` will sync information from any organizations that the provided credential has Administrator permissions on. You can specify exactly which organizations you would like to sync using the `--orgs` flag.
 
@@ -78,7 +82,7 @@ Flags:
       --app-privatekey-path string                       Path to private key that is used to connect to the GitHub App. Ignored when app-privatekey is set. ($BATON_APP_PRIVATEKEY_PATH)
       --client-id string                                 The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID)
       --client-secret string                             The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET)
-      --enterprises strings                              Sync enterprise roles, must be an admin of the enterprise. ($BATON_ENTERPRISES)
+      --enterprises strings                              Sync enterprise roles, must be an admin of the enterprise. A personal access token syncs every role. A GitHub App syncs and provisions the built-in Owner role instead, and needs to be installed on the enterprise account as well as on the organization, with the "Enterprise people: read and write" permission. ($BATON_ENTERPRISES)
       --external-resource-c1z string                     The path to the c1z file to sync external baton resources with ($BATON_EXTERNAL_RESOURCE_C1Z)
       --external-resource-entitlement-id-filter string   The entitlement that external users, groups must have access to sync external baton resources ($BATON_EXTERNAL_RESOURCE_ENTITLEMENT_ID_FILTER)
   -f, --file string                                      The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z")
@@ -113,3 +117,10 @@ Org:
 Repo:
 - Administrator: Read and Write
   - This permission implies Metadata: Read
+
+Enterprise, only when `--enterprises` is set:
+- GitHub App: People: Read and Write, and the app installed on the enterprise
+  account as well as the organization — required to sync and provision the
+  built-in Enterprise Owner role
+- Personal access token: `read:enterprise` — required to sync enterprise roles
+  and licenses

baton_capabilities.json

@@ -55,6 +55,29 @@
         ]
       }
     },
+    {
+      "resourceType": {
+        "id": "enterprise_role",
+        "displayName": "Enterprise Role",
+        "traits": [
+          "TRAIT_ROLE"
+        ],
+        "annotations": [
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.V1Identifier",
+            "id": "enterprise_role"
+          },
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.SkipEntitlements"
+          }
+        ]
+      },
+      "capabilities": [
+        "CAPABILITY_SYNC",
+        "CAPABILITY_PROVISION"
+      ],
+      "permissions": {}
+    },
     {
       "resourceType": {
         "id": "invitation",
@@ -80,6 +103,32 @@
       "permissions": {},
       "skipSyncAnomalyDetection": true
     },
+    {
+      "resourceType": {
+        "id": "license",
+        "displayName": "License",
+        "traits": [
+          "TRAIT_LICENSE_PROFILE"
+        ],
+        "annotations": [
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.V1Identifier",
+            "id": "license"
+          },
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.SkipEntitlements"
+          },
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.OptInRequired"
+          }
+        ]
+      },
+      "capabilities": [
+        "CAPABILITY_SYNC"
+      ],
+      "permissions": {},
+      "optInRequired": true
+    },
     {
       "resourceType": {
         "id": "org",
@@ -166,6 +215,24 @@
       ],
       "permissions": {}
     },
+    {
+      "resourceType": {
+        "id": "usage-app",
+        "displayName": "GitHub Activity",
+        "traits": [
+          "TRAIT_APP"
+        ],
+        "annotations": [
+          {
+            "@type": "type.googleapis.com/c1.connector.v2.SkipGrants"
+          }
+        ]
+      },
+      "capabilities": [
+        "CAPABILITY_SYNC"
+      ],
+      "permissions": {}
+    },
     {
       "resourceType": {
         "id": "user",
@@ -191,7 +258,8 @@
     "CAPABILITY_PROVISION",
     "CAPABILITY_SYNC",
     "CAPABILITY_ACCOUNT_PROVISIONING",
-    "CAPABILITY_RESOURCE_DELETE"
+    "CAPABILITY_RESOURCE_DELETE",
+    "CAPABILITY_EVENT_FEED_V2"
   ],
   "credentialDetails": {
     "capabilityAccountProvisioning": {

cmd/baton-github/main.go

@@ -14,5 +14,8 @@ var version = "dev"
 
 func main() {
 	ctx := context.Background()
-	config.RunConnector(ctx, "baton-github", version, cfg.Config, connector.NewLambdaConnector, connectorrunner.WithSessionStoreEnabled())
+	config.RunConnector(ctx, "baton-github", version, cfg.Config, connector.NewLambdaConnector,
+		connectorrunner.WithSessionStoreEnabled(),
+		connectorrunner.WithDefaultCapabilitiesConnectorBuilderV2(&connector.DefaultCapabilitiesBuilder{}),
+	)
 }

config_schema.json

@@ -113,7 +113,7 @@
     {
       "name": "enterprises",
       "displayName": "Enterprises",
-      "description": "Sync enterprise roles, must be an admin of the enterprise.",
+      "description": "Sync enterprise roles, must be an admin of the enterprise. A personal access token syncs every role. A GitHub App syncs and provisions the built-in Owner role instead, and needs to be installed on the enterprise account as well as on the organization, with the \"Enterprise people: read and write\" permission.",
       "stringSliceField": {}
     },
     {