Implement federated sign-in buttons and associated logic for Google and GitHub

[brionmario]

Purpose

Adds federated (social) sign-in support to the Android SDK — Google, GitHub, and passkey trigger actions are now rendered and wired into the SignIn flow, backed by a Custom Tabs browser round-trip for the OAuth redirect. This also fixes a flow-parsing bug that was silently dropping those buttons, and cleans up leftover/duplicate code from earlier WIP.

Approach

• Federated action matching fix (SignIn.kt) — the real Flow Execution API identifies a node by ref on the flat data.actions array but by id on the matching node inside data.meta.components (same value, different field per side). The existing lookup compared ref==ref / id==id only, so it never matched across the two shapes — any ACTION node under a BLOCK, including the Google/GitHub/passkey triggers, silently rendered nothing. Fixed enrichActions and ActionComponentView to key off ref ?: id on both sides.
• FederatedAuthSession — bridges the browser round-trip for TRIGGER (federated) actions: launches a Custom Tab for the provider redirect and suspends until the host Activity forwards the deep-link callback via onRedirect, with cancelIfPending to resolve gracefully if the user dismisses the browser. Added the missing androidx.browser dependency this needed to compile.
• Branded buttons (GoogleButton, GitHubButton) — dedicated, styled trigger buttons using the official brand marks, added as drawable resources for pixel-accurate rendering rather than hand-drawn glyphs.
• Cleanup — removed an orphaned, unwired duplicate adapter package left over from earlier WIP, and removed a hardcoded forgot-password/sign-up footer in the quickstart sample that duplicated what the flow's own components already render (see screenshot above for the corrected, flow-driven UI).

Related Issues

• Federated Social Login buttons for Mobile SDKs thunderid#3811

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• New Features

  • Added browser-based social sign-in support, including redirect handling back into the app.
  • Added dedicated Google and GitHub sign-in buttons with branded styling.
  • Sign-in screens now better recognize and route provider-specific trigger actions.

• Bug Fixes

  • Improved handling for incomplete sign-in and sign-up responses so flows continue more reliably.
  • Sign-in cancellations from the browser are now handled more cleanly without surfacing unnecessary errors.

[coderabbitai]

Warning

Review limit reached

@brionmario, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2ecd3d6-c17a-48df-9ec7-a463096e5a8f

📥 Commits

Reviewing files that changed from the base of the PR and between e22131a and 16046fc.

📒 Files selected for processing (9)

• samples/quickstart/src/main/kotlin/dev/thunderid/quickstart/AuthScreen.kt
• src/main/kotlin/dev/thunderid/android/Models.kt
• src/main/kotlin/dev/thunderid/compose/components/actions/adapters/GitHubButton.kt
• src/main/kotlin/dev/thunderid/compose/components/actions/adapters/GoogleButton.kt
• src/main/kotlin/dev/thunderid/compose/components/actions/adapters/OutlinedTriggerButton.kt
• src/main/kotlin/dev/thunderid/compose/components/actions/adapters/TriggerButtonStyle.kt
• src/main/kotlin/dev/thunderid/compose/components/presentation/auth/SignIn.kt
• src/main/kotlin/dev/thunderid/compose/i18n/FlowTemplateResolver.kt
• src/test/kotlin/dev/thunderid/android/FlowMetaModelsTest.kt

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}