feat(github): Handle installation_repositories webhook

[wedamija]

Currently, we only sync the available repositories from Github on installing the integration. So over time, if new repositories are added to the github organization, or access to specific repositories is added or removed, we end up out of sync with which repositories we store in Sentry.

To fix this, we are going to start handling the installation_repositories webhook. This is fired whenever the repositories that a github app can access change. This allows us to keep all the repos in sync.

Note that when access to a repo is removed, we only ever disable the repo and never delete it. This allows us to keep the history of commits and so on so far.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Duplicate RPC call to fetch organization per iteration
  • Eliminated duplicate organization_service.get() call by fetching the organization once in the main loop and passing it to _sync_repos_for_org instead of fetching it again inside the function.

Or push these changes by commenting:

@cursor push 3a1e5c4352

Preview (3a1e5c4352)

diff --git a/src/sentry/integrations/github/tasks/sync_repos_on_install_change.py b/src/sentry/integrations/github/tasks/sync_repos_on_install_change.py
--- a/src/sentry/integrations/github/tasks/sync_repos_on_install_change.py
+++ b/src/sentry/integrations/github/tasks/sync_repos_on_install_change.py
@@ -13,6 +13,7 @@
     SCMIntegrationInteractionType,
 )
 from sentry.organizations.services.organization import organization_service
+from sentry.organizations.services.organization.model import RpcOrganization
 from sentry.plugins.providers.integration_repository import (
     RepoExistsError,
     RepositoryInputConfig,
@@ -78,10 +79,18 @@
 
     for oi in org_integrations:
         organization_id = oi.organization_id
+        rpc_org = organization_service.get(id=organization_id)
 
+        if rpc_org is None:
+            logger.info(
+                "sync_repos_on_install_change.missing_organization",
+                extra={"organization_id": organization_id},
+            )
+            continue
+
         if not features.has(
             "organizations:github-repo-auto-sync",
-            organization_service.get(id=organization_id),
+            rpc_org,
         ):
             continue
 
@@ -93,7 +102,7 @@
         ).capture():
             _sync_repos_for_org(
                 integration=integration,
-                organization_id=organization_id,
+                rpc_org=rpc_org,
                 provider=provider,
                 repos_added=repos_added,
                 repos_removed=repos_removed,
@@ -103,19 +112,11 @@
 def _sync_repos_for_org(
     *,
     integration: RpcIntegration,
-    organization_id: int,
+    rpc_org: RpcOrganization,
     provider: str,
     repos_added: list[GitHubRepo],
     repos_removed: list[GitHubRepo],
 ) -> None:
-    rpc_org = organization_service.get(id=organization_id)
-    if rpc_org is None:
-        logger.info(
-            "sync_repos_on_install_change.missing_organization",
-            extra={"organization_id": organization_id},
-        )
-        return
-
     if repos_added:
         integration_repo_provider = get_integration_repository_provider(integration)
         repo_configs: list[RepositoryInputConfig] = []
@@ -137,7 +138,7 @@
     if repos_removed:
         external_ids = [str(repo["id"]) for repo in repos_removed]
         repository_service.disable_repositories_by_external_ids(
-            organization_id=organization_id,
+            organization_id=rpc_org.id,
             integration_id=integration.id,
             provider=provider,
             external_ids=external_ids,

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[evanpurkhiser]

Why is it that it's not supported?

[evanpurkhiser]

We just didn't have any tests for this file before?

[wedamija]

Yeah, although maybe we tested outside the impl instead? Not sure

[getsentry-bot]

PR reverted: ca7fcd4

[github-actions]

Backend Test Failures

Failures on a8a8009 in this run:

tests/sentry/taskworker/test_config.py::test_all_instrumented_tasks_registered — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/taskworker/test_config.py:120: in test_all_instrumented_tasks_registered
    raise AssertionError(
E   AssertionError: Found 1 module(s) with @instrumented_task that are NOT registered in TASKWORKER_IMPORTS.
E   These tasks will not be discovered by the taskworker in production!
E   
E   Missing modules:
E     - sentry.integrations.github.tasks.sync_repos_on_install_change
E   
E   Add these to TASKWORKER_IMPORTS in src/sentry/conf/server.py