Implement support for Github enterprise applications

[meik99]

Implements #516

Summary of changes

This PR adds support for GitHub Enterprise Apps, which work differently from regular GitHub Apps in that they can have multiple installation IDs across an organization rather than a single one. The operator now auto-discovers all installation IDs for an enterprise app by querying the GitHub API, fetches a short-lived token for each installation, and stores those tokens as Kubernetes Secrets named after the installation.

A new CRD field githubEnterpriseAppReference was added alongside the existing githubAppReference. The reconciler and job manager were updated to track which projects belong to which installation, preventing projects from one installation from being overwritten by another, and token secret names are now carried as annotations on project objects and threaded through to the Kubernetes Jobs that actually run Renovate.

The discovery agent was extended to schedule discovery jobs for enterprise app installations, and webhook sync options were wired in as well.

How to test

Prerequisites

• You have a GitHub Enterprise App (not a regular installation-scoped App) with at least two organizations or accounts that have installed it
• You have the App ID and a PEM private key for the enterprise app
• The operator is running in a cluster with access to the GitHub API

Secret and CRD setup

• Create a Kubernetes Secret containing the App ID and PEM key (no installationIdSecretKey needed)
• Create a RenovateJob using spec.githubEnterpriseAppReference (referencing the secret, appIdSecretKey, and pemSecretKey), leaving githubAppReference absent — confirm the CRD is accepted by the API server without validation errors

Token creation per installation

• After the RenovateJob reconciles, confirm that one Kubernetes Secret is created per installation ID (named in the form {job}-github-app-{installationID}-{hash}, max 63 chars), each containing a RENOVATE_TOKEN key

Discovery jobs

• Confirm that one discovery Kubernetes Job is created per installation, each annotated with renovate-operator.mogenius.com/token-secret-name pointing to the correct per-installation Secret
• Confirm each discovery Job has the per-installation Secret mounted as an env source

Project reconciliation and ownership

• After discovery completes for all installations, confirm that each ProjectStatus on the RenovateJob carries a tokenSecretName matching the installation that owns it
• Confirm that repos belonging to installation A are not cleared when installation B runs its discovery pass

Webhook sync

• With spec.webhook.sync enabled, confirm that webhook sync runs per installation using that installation's token rather than a job-level default

Executor job dispatch

• Confirm that executor Jobs for projects with a non-empty tokenSecretName mount that per-installation Secret rather than the job-level one

Regression: regular githubAppReference

• Create a separate RenovateJob using the existing githubAppReference (with installationIdSecretKey) and confirm it still works end-to-end — a single token Secret is created, a single discovery Job runs, and projects are reconciled as before

[Copilot]

Pull request overview

Adds first-class support for GitHub Enterprise App–style authentication by introducing a GithubEnterpriseAppReference that lets the operator discover org installations automatically, mint per-installation tokens, and run discovery/executor jobs with the correct token secret per project.

Changes:

• Extend the CRD/API to support githubEnterpriseAppReference and persist per-project tokenSecretName.
• Mint/refresh GitHub App tokens per installation (/app/installations) and create one discovery job per installation.
• Propagate per-installation token secrets through discovery reconciliation, executor dispatch, and webhook sync grouping.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/webhook/mock_test.go	Updates webhook manager mock signatures for new project status/token-aware APIs.
src/ui/renovateController_test.go	Updates UI controller mock signatures to match updated manager interfaces.
src/internal/renovate/jobDefinitions.go	Adds helper to attach per-installation token secrets to already-built Jobs.
src/internal/renovate/jobDefinitions_test.go	Adds unit test coverage for token-secret envFrom attachment behavior.
src/internal/renovate/executor.go	Ensures executor jobs mount per-project token secret when present.
src/internal/renovate/discoveryAgent.go	Threads token secret name through discovery job creation and result processing.
src/internal/renovate/discoveryAgent_test.go	Updates discovery agent test fakes for new reconciliation/webhook APIs.
src/internal/crdManager/renovateJobManager.go	Stores token secret per project and groups webhook sync by token secret.
src/internal/crdManager/renovateJobManager_test.go	Adds tests for TokenSecretName behavior during reconciliation.
src/internal/crdManager/jobManager.go	Adds discovery-job scoping labels/selector for per-installation token secret.
src/github/githubAppToken.go	Refactors token minting and adds enterprise-app installation token management.
src/github/githubAppToken_test.go	Adds/updates tests for PEM/JWT helpers and enterprise token workflows.
src/github/githubAppSecretNames.go	Adds deterministic secret naming per installation ID while respecting k8s limits.
src/github/githubAppSecretNames_test.go	Adds tests for per-installation secret naming and truncation/uniqueness.
src/controllers/renovatejob_controller.go	Dispatches discovery per installation for enterprise apps and ensures tokens in reconcile.
src/controllers/renovatejob_controller_test.go	Updates controller fakes/mocks for new GithubAppToken interface method.
src/api/v1alpha1/renovatejob_types.go	Adds GithubEnterpriseAppReference, shared credentials struct, and per-project TokenSecretName.
CLAUDE.md	Adds “Planned Work” section (currently references a missing TODO.md).
charts/renovate-operator/crd/renovate-operator.mogenius.com_renovatejobs.yaml	Updates generated CRD schema for enterprise app reference and TokenSecretName.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/api/v1alpha1/renovatejob_types.go:240

• This comment has inconsistent capitalization (GitHub), a hard tab (which bleeds into generated CRD descriptions), and an overly long line. Since this text is surfaced in the CRD schema, it should be clean and consistently formatted.

	// TokenSecretName names the Kubernetes Secret holding RENOVATE_TOKEN for this project.
	// When non-empty the executor uses it instead of the job-level default.
	// Needed since for github enterprise applications, a job creates executor pods for projects that are potentially in different organisations
	// 		and each organisation has its own installation ID and therefore its own token.
	// +optional

[meik99]

@beneiltis @lukashankeln @wittdennis btw, do you want the commits squashed or do you prefer them split like it is now so can review them one by one?
I was about to squash them, but then I thought I'd better ask first, since I can't really un-squash them 😅