fix(worker): use Ask GitHub PAT for repository auth

[brendan-kellam]

Summary

• add EXPERIMENT_ASK_GH_GITHUB_TOKEN as an optional server environment variable
• prefer the configured Ask GitHub PAT before GitHub App and connection credential resolution
• inject the PAT only for GitHub clone URLs

Test plan

• yarn workspace @sourcebot/backend test --run src/utils.test.ts
• yarn workspace @sourcebot/backend build

---

Note

Medium Risk
Changes how GitHub service credentials are chosen for clone/sync when the experimental PAT is set, which can override GitHub App and connection tokens cluster-wide; scope is limited to opt-in env configuration.

Overview
Adds optional EXPERIMENT_ASK_GH_GITHUB_TOKEN and, when set, makes getAuthCredentialsForRepo return that PAT for GitHub repos before GitHub App installation tokens or per-connection credentials. Clone URLs use the standard x-access-token embedded-auth form.

A unit test asserts this precedence even when the repo has no connections. Worker flows that already call getAuthCredentialsForRepo (e.g. repo indexing and permission sync) will automatically use the PAT when the env is configured.

^{Reviewed by Cursor Bugbot for commit 9efa345. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features

  • Added experimental support for using a dedicated GitHub token when accessing GitHub repositories.
  • Authenticated clone URLs are generated automatically when the feature is enabled.

• Tests

  • Added coverage verifying GitHub authentication credentials and clone URL generation.

[github-actions]

@brendan-kellam your pull request is missing a changelog!

[coderabbitai]

Walkthrough

Adds an optional Ask GitHub token environment variable and an early GitHub-specific credential path that returns the token and an authenticated clone URL. Tests cover token selection, clone URL construction, and environment restoration.

Changes

GitHub token authentication

Layer / File(s)	Summary
Experimental token environment contract packages/shared/src/env.server.ts	Adds the optional EXPERIMENT_ASK_GH_GITHUB_TOKEN server environment variable.
GitHub credential selection packages/backend/src/utils.ts, packages/backend/src/utils.test.ts	Uses the experimental token for GitHub repository credentials and authenticated clone URLs, with tests covering the returned values and environment cleanup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Repo as GitHub repository
  participant Auth as getAuthCredentialsForRepo
  participant Env as env.EXPERIMENT_ASK_GH_GITHUB_TOKEN
  participant Clone as createGitCloneUrlWithToken
  Repo->>Auth: provide repository metadata
  Auth->>Env: read experimental token
  Auth->>Clone: create clone URL with x-access-token and PAT
  Clone-->>Auth: return authenticated clone URL
  Auth-->>Repo: return hostUrl, token, and cloneUrlWithToken

Loading

Suggested reviewers: msukkari, steven-nagie, waynesun09, drew-u410

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: preferring the Ask GitHub PAT for GitHub repository authentication.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/ask-gh-pat-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/backend/src/utils.ts`:
- Around line 118-133: Restrict the Ask GitHub PAT branch in the repository
authentication flow to GitHub repositories whose external host matches the
intended GitHub hostname, in addition to the existing external_codeHostType and
EXPERIMENT_ASK_GH_GITHUB_TOKEN checks. Only call createGitCloneUrlWithToken and
return the PAT-based credentials for that matching host; preserve the existing
per-connection authentication path for other GitHub hosts.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9ccd1c2d-24a7-48f9-8861-e76a8062e8f1

📥 Commits

Reviewing files that changed from the base of the PR and between fb922cd and 9efa345.

📒 Files selected for processing (3)

• packages/backend/src/utils.test.ts
• packages/backend/src/utils.ts
• packages/shared/src/env.server.ts