Add GitHub discovery integration MVP

[gearnode]

Summary

Addresses workflow discovery gaps: substring matching missed YAML variants, and measures counted configured tools without verifying they actually run.

Running evidence now comes from both:

• GET /repos/{owner}/{repo}/commits/{sha}/check-runs
• GET /repos/{owner}/{repo}/commits/{sha}/status (legacy commit statuses)

Two-layer model:

Layer	Source	Used for
Configured	YAML parse (on: triggers, uses: actions)	Risk signals: pull_request_target, workflow secrets
Running	Check runs + commit statuses on default branch and recent merged PR	Positive measures: CodeQL, SAST, dep scan, PR CI

External CI (CircleCI, Jenkins, etc.) often reports only via commit status context — PR CI detection now accepts known CI providers from statuses on merged PR commits.

Test plan

• go test ./pkg/discovery/github/...
• make go-fmt
• go fix clean

  

---

Summary by cubic

Adds a read-only GitHub discovery that scans org governance and repos, builds a MeasurePlan from facts, and links measures to a level‑1 GitHub ThirdParty. CI evidence now verifies tools via check runs and commit statuses on default branches and merged PRs; YAML parsing stays for risk signals like pull_request_target.

Tests +1243 -41

• Coverage for vfs (walk/glob, gitfs), workflow parsing/run signals incl. commit statuses, repo selection/classification (heuristics + optional LLM), scanners, MeasurePlan by measure name, third‑party linking, and worktree‑indexed discovery.
• Updates for agent‑run worker/registry and provider discovery scopes.

GraphQL API +95 -0

• Adds runGitHubDiscovery(input: { connectorId }) returning an agentRun.
• Exposes discoveryOauth2Scopes; CreateMeasureInput accepts thirdPartyIds. Wires the GitHub discovery service.

MCP +192 -20

• Adds runGitHubDiscovery tool and AgentRun types/statuses.
• Extends AddMeasureInput with third_party_ids.

prb (CLI) +16 -10

• measure create supports --third-party-ids.
• Switch asset/datum flags to kebab‑case --third-party-ids.

Service +7577 -16

• New pkg/discovery/github: org/repo/governance/PR/status scanners, MeasurePlan builder/synthesizer, runner/run handler, persistence; joins by measure name and links to a level‑1 GitHub ThirdParty.
• CI measures counted from check runs and commit statuses; YAML analysis kept for risk signals.
• Discovery vfs: Walk/Glob, gitfs shallow clones, layered FS fallback; repo selection via heuristics with optional LLM.
• Validates discovery OAuth scopes; core calls use google/go-github on the instrumented httpclient; registers a run handler on the shared agent‑run worker.
• Minor fixes: go fix updates and lint cleanups.

Package: n8n-node +19 -0

• Adds “Third Party IDs” to measure.create (CSV to thirdPartyIds).

Other +976 -0

• Design doc and Helm values/env for discovery worker and LLM settings.
• Adds github.com/google/go-github/v69 dependency.

^{Written for commit 7edb499. Summary will update on new commits.}