[Defilan]

What

Routes the Foreman agent paths that still hardcoded GitHub through the injected CodeHost / WorkItems seams. This is the groundwork #1300, forge provider selection, needs. Without it, choosing a forge would change only part of a run.

Why

Part of #1300, and finishes what #1298 started.

#1298 moved the executor's clone and the gate tool onto the seams, but a survey of current main found four paths still on the package GitHub defaults:

• resolveUpstreamForRun (executor_native.go) ignored e.CodeHost. It feeds the envtest gate's and the scan gate's upstream URL, the self-commit-recovery and claim-evidence base SHAs, and the reviewer diff base.
• buildDeterministicArgs built the gate's upstreamURL, which the bite check fetches the base from, with upstreamURLForRepo, the GitHub default.
• The tool registry (makeRegistryFactory in cmd/foreman-agent/main.go) never set ToolDeps.CodeHost or ToolDeps.WorkItems. So in production fetch_issue and the gate tool's clone-URL fallback always used GitHub, on both the daemon and run-task paths.
• TestResolveUpstreamPrefersInjectedCodeHost re-implemented the selection in a closure inside the test instead of calling the executor. It couldn't fail on a production regression.

How

• One resolver. NativeAgentLoopExecutor.upstreamURL(slug) checks, in order: the test override, the injected CodeHost, then the GitHub default. Execute's clone, resolveUpstreamForRun and the deterministic gate args all use it now. buildDeterministicArgs takes the resolved upstreamURL instead of deriving it.
• One set of seams per executor. The daemon and run-task each build a forgeSeams once. The same instances go to the executor and, through makeRegistryFactory, into ToolDeps.
• Token rotation kept.
  • fetch_issue deliberately resolved its token on every call, so a rotated token worked without a restart. The production seams read the token once, at startup, so injecting them as-is would have quietly removed that.
  • GitHubCodeHost and GitHubWorkItems gain a TokenSource that is resolved per call when Token is empty, and production wires it to repo.TokenFromEnvOrFile.
  • The executor's PR and issue calls, which already used the startup token, get rotation too.
  • A resolution error means an unauthenticated call, as the startup token, _ := read did.

Not in this PR

• fetch_pull_request stays GitHub-only. A provider-neutral PR-read seam can't live in codehost, because githubprfetch already imports codehost. It fits the optional-capability / ErrNotSupported pattern [FEATURE] Forge provider selection: registry, forge and apiBaseURL configuration #1300 introduces, so it lands there. While GitHub is the only built-in provider, nothing changes in behavior.
• The provider registry and the forge / apiBaseURL settings are [FEATURE] Forge provider selection: registry, forge and apiBaseURL configuration #1300 itself, in the next PR.

Behavior changes

• fetch_issue without a token now makes an unauthenticated request, which works for public repos, instead of failing early with "no GitHub token". That's what the executor's own issue fetch already did through the same seam.
• Nothing else changes for a GitHub fleet. The GitHub adapters produce the same URLs and calls.

Testing

make gate passes: regen, drift, fmt, vet, lint-all and the full suite.

The first gate run hit TestRegistrar_Run_ReRegistersWhenFleetNodeDeleted. That's the FleetNode registrar, which this PR doesn't touch. It passes 10 of 10 in isolation both with and without this change, and it passed on the rerun. It's a timing flake that was already there: the test sleeps 30ms, deletes the FleetNode, and expects NotFound, but under load the registrar's next heartbeat can recreate the object first.

New and changed tests:

• TestResolveUpstreamPrefersInjectedCodeHost: now calls e.upstreamURL instead of a copy of it.
• TestResolveUpstreamForRunUsesInjectedCodeHost: the post-clone paths use the seam, and the test override still wins.
• TestExecuteDeterministicPassesCodeHostUpstream: a deterministic run_gate_job dispatch carries the injected forge's upstream URL.
• TestRegistryFactoryThreadsForgeSeamsIntoTools (cmd/foreman-agent): builds the real registry with makeRegistryFactory and dispatches fetch_issue. The injected WorkItems answers.
• TestGitHubCodeHostTokenSourcePerCall / TestGitHubWorkItemsTokenSourcePerCall: a rotated token reaches the next call, an explicit Token wins, and a resolution error means unauthenticated.

Bite checks, with each fix reverted on its own:

• upstreamURL ignores CodeHost:

  executor_upstream_test.go:190: clone URL = "https://github.com/group/sub/project.git", want "https://forge.example.org/group/sub/project.git" (injected CodeHost bypassed)
  

• Deterministic args from the GitHub default:

  executor_upstream_test.go:253: args[upstreamURL] = https://github.com/group/sub/project.git, want "https://forge.example.org/group/sub/project.git" from the injected CodeHost
  

• Registry factory drops the seams:

  forge_seams_test.go:54: fetch_issue: fetch_issue: no GitHub token (set GITHUB_TOKEN env or populate ~/.config/foreman/github-token on the FleetNode): ...
  

• Code host token resolved once:

  codehost_test.go:460: tokens used = ["" "" "" "pinned"], want ["first" "rotated" "" "pinned"]
  

• Work items token resolved once:

  worktracker_test.go:260: tokens used = ["" "" ""], want ["first" "rotated" ""]
  

Checklist

• Tests added/updated
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change): no user-facing change for a GitHub fleet

AI assistance: this change was AI-assisted. I reviewed the diffs and supervised the build.

[codecov]

Codecov Report

❌ Patch coverage is 71.05263% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/foreman-agent/main.go	15.38%	11 Missing ⚠️

📢 Thoughts on this report? Let us know!