chore: import upstream snapshot with attribution

integrations/github/login.py

@@ -0,0 +1,78 @@
+"""Streamlined GitHub device-flow login that configures the hosted GitHub MCP integration.
+
+Used by the first-launch gate to authenticate the user, persist the hosted
+GitHub MCP integration, and surface the authenticated GitHub username. Reuses
+the same hosted defaults as ``opensre integrations setup github`` (no transport
+or advanced prompts).
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+
+from integrations.github.mcp import (
+    DEFAULT_GITHUB_MCP_MODE,
+    DEFAULT_GITHUB_MCP_TOOLSETS,
+    DEFAULT_GITHUB_MCP_URL,
+    build_github_mcp_config,
+    validate_github_mcp_config,
+)
+from integrations.github.mcp_oauth import (
+    GitHubDeviceCode,
+    authorize_github_via_device_flow,
+)
+from integrations.store import upsert_integration
+
+
+@dataclass(frozen=True)
+class GitHubLoginResult:
+    """Outcome of a device-flow login + hosted GitHub MCP configuration attempt."""
+
+    ok: bool
+    username: str = ""
+    detail: str = ""
+
+
+def authenticate_and_configure_github(
+    *,
+    on_prompt: Callable[[GitHubDeviceCode], None] | None = None,
+    open_browser: bool = True,
+    poll_sleep: Callable[[float], None] | None = None,
+) -> GitHubLoginResult:
+    """Run device-flow login, validate, and persist the hosted GitHub MCP integration.
+
+    The device flow may raise ``GitHubDeviceFlowError`` (or transport errors); those
+    propagate to the caller so it can present a message and decide whether to retry.
+    The integration is persisted only when validation succeeds.
+    """
+    token = authorize_github_via_device_flow(
+        on_prompt=on_prompt,
+        open_browser=open_browser,
+        poll_sleep=poll_sleep,
+    )
+    credentials: dict[str, object] = {
+        "mode": DEFAULT_GITHUB_MCP_MODE,
+        "url": DEFAULT_GITHUB_MCP_URL,
+        "auth_token": token.access_token,
+        "toolsets": list(DEFAULT_GITHUB_MCP_TOOLSETS),
+    }
+    result = validate_github_mcp_config(build_github_mcp_config(credentials))
+    if not result.ok:
+        return GitHubLoginResult(
+            ok=False,
+            username=result.authenticated_user,
+            detail=result.detail,
+        )
+    if result.authenticated_user:
+        # Persist the resolved GitHub login as a non-secret credential field so
+        # surfaces like the welcome banner can greet the user by their GitHub
+        # handle instead of the local system username.
+        credentials["username"] = result.authenticated_user
+    upsert_integration("github", {"credentials": credentials})
+    username = result.authenticated_user
+    if username:
+        from platform.analytics.cli import identify_github_username
+
+        identify_github_username(username)
+    return GitHubLoginResult(ok=True, username=username, detail=result.detail)