fleet: busbar pin -> predev 41fd7c5f38; tests at the pin's contract

.busbar-ref

@@ -1 +1 @@
-33671357f37a411fd135a2d15cbed3d9947f34f0 1.6.0
+41fd7c5f386fa098890c031721f19bfca903f225 1.6.0

.github/CODEOWNERS

@@ -1,2 +1,2 @@
-# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/.
+# RENDERED by `busbar-release plugin heal` from GetBusbar/busbar-release template/.
 * @MattJackson

.github/workflows/ci.yml

@@ -1,25 +1,35 @@
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/; a hand
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/; a hand
 # edit is overwritten by the next sync. THIS REPO TESTS ITSELF AGAINST BUSBAR with the fleet's ONE
 # harness: busbar's reusable plugin-ci.yml, taken at the busbar commit this repo pins (.busbar-ref), so
 # the CI logic, the gates (busbar scripts/fleet/plugin-gates.py), the dependency policy
 # (.github/fleet/deps.toml) and the contract move together (OWNER 2026-10-02). No CI logic lives here.
 name: ci
 
 on:
+  # A tree is tested once: on its pull request into dev and on the push that lands it on dev. qa and
+  # main take dev's commits by pull request whose head is that tested commit: the checks it carries
+  # from dev's run satisfy the ruleset, and nothing re-tests it. Any other head: run this by hand
+  # (workflow_dispatch) on its branch.
   push:
-    branches: [dev, qa, main]
+    branches: [dev]
   pull_request:
-    branches: [dev, qa, main]
+    branches: [dev]
   workflow_dispatch: {}
   # release.yml runs this file on the tagged commit before it publishes.
   workflow_call: {}
 
+# A newer push to a pull request cancels its older run (only the newest commit can merge); a push to
+# dev, a dispatch and release.yml's call run to the end.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@33671357f37a411fd135a2d15cbed3d9947f34f0
+    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@41fd7c5f386fa098890c031721f19bfca903f225
     with:
       service: wiremock
       busbar_checkout: true

.github/workflows/consumer-verify.yml

@@ -1,12 +1,12 @@
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/; a hand
-# edit is overwritten by the next sync. Daily: does the newest
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync. Weekly: does the newest
 # PUBLISHED release still work for a user (busbar's plugin-consumer-verify.yml)? A publish-time check
 # cannot see an artifact that rots afterwards; release.yml verifies each release as it publishes.
 name: consumer-verify
 
 on:
   schedule:
-    - cron: "45 9 * * *"
+    - cron: "59 9 * * 1"
   workflow_dispatch:
     inputs:
       version:
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   consumer:
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@33671357f37a411fd135a2d15cbed3d9947f34f0
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@41fd7c5f386fa098890c031721f19bfca903f225
     with:
       version: ${{ inputs.version || '' }}
       asset_prefix: busbar-auth-github

.github/workflows/dependabot-bundle.yml

@@ -1,4 +1,4 @@
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/; a hand
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/; a hand
 # edit is overwritten by the next sync (DEPENDABOT-ONE).
 # dependabot-bundle: every open dependabot PR (whatever its base today) is merged into ONE branch (deps/bundle),
 # which carries ONE PR with auto-merge on. Merged PRs are closed with a link; a PR that conflicts
@@ -13,7 +13,7 @@ on:
     types: [opened, synchronize]
     branches: [dev]
   schedule:
-    - cron: "23 5 * * *"
+    - cron: "23 5 * * 1"
   workflow_dispatch:
 permissions:
   contents: write

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/; a hand
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/; a hand
 # edit is overwritten by the next sync. On a v* tag: this repo's own ci.yml (the fleet harness) on the
 # tagged commit, then busbar's plugin-release.yml (build, sign, pack, publish), then the consumer
 # verification of what was published, each at the busbar commit this repo pins.
@@ -25,7 +25,7 @@ jobs:
     secrets: inherit
   release:
     needs: ci
-    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@33671357f37a411fd135a2d15cbed3d9947f34f0
+    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@41fd7c5f386fa098890c031721f19bfca903f225
     with:
       plugin_crate: busbar-auth-github-plugin
       manifest_name: busbar-auth-github
@@ -37,11 +37,12 @@ jobs:
       needs_prompt: ""
       needs_user: ""
       declares_file: "busbar-auth-github/declares.json"
+      former_names: "busbar-auth-github-plugin"
     secrets: inherit
   consumer-verify:
     needs: release
     if: ${{ !cancelled() }}
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@33671357f37a411fd135a2d15cbed3d9947f34f0
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@41fd7c5f386fa098890c031721f19bfca903f225
     with:
       version: ${{ github.ref_name }}
       asset_prefix: busbar-auth-github

.github/workflows/repin.yml

@@ -1,4 +1,4 @@
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/; a hand
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/; a hand
 # edit is overwritten by the next sync. Moves this repo's
 # busbar pin (busbar's plugin-repin.yml) when busbar dispatches `busbar-repin` or on demand; the
 # cut/skip decision is by commit, and the commit goes to dev only.
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   repin:
-    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@33671357f37a411fd135a2d15cbed3d9947f34f0
+    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@41fd7c5f386fa098890c031721f19bfca903f225
     with:
       busbar_sha: ${{ github.event.client_payload.sha || inputs.busbar_sha }}
       busbar_version: ${{ github.event.client_payload.version || inputs.busbar_version }}

.gitignore

@@ -1,4 +1,4 @@
-# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/ (the plugins.yaml
+# RENDERED by `busbar-release plugin heal` from GetBusbar/busbar-release template/ (the plugins.yaml
 # entry's `gitignore:` lines follow the fleet's own).
 /target
 /mutants.out*

.mailmap

@@ -1,4 +1,4 @@
-# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/.
+# RENDERED by `busbar-release plugin heal` from GetBusbar/busbar-release template/.
 # Canonical authorship. Commits go out under Matthew Jackson's GitHub noreply only.
 Matthew Jackson <1085847+MattJackson@users.noreply.github.com> <dev3@getbusbar.com>
 Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Matthew <dev3@getbusbar.com>

CONTRIBUTING.md

@@ -7,14 +7,14 @@ Thanks for your interest in improving `busbar-auth-github`.
 - Be respectful and constructive in all project spaces (see
   [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)).
 - By contributing, you agree your contributions are licensed under the project's
-  [MIT](LICENSE) license.
+  [Apache-2.0](LICENSE) license.
 - Security issues go through [SECURITY.md](SECURITY.md), **not** public issues.
 
 ## Layout
 
 Every busbar plugin repo has the same skeleton. This one is a two-crate Cargo workspace: `auth-github/` holds the plugin's logic and `auth-github-plugin/` is the thin `cdylib` that packages it as a droppable `kind: auth` plugin. busbar itself is a git dependency
 pinned to the commit in `.busbar-ref`. The CI, release, dependency and lint configuration
-are rendered by `busbar-release plugin sync` from the fleet template (GetBusbar/busbar-release
+are rendered by `busbar-release plugin heal` from the fleet template (GetBusbar/busbar-release
 `template/`), [busbar's plugin registry](https://github.com/GetBusbar/busbar/blob/main/plugins.yaml)
 and busbar's dependency policy (`.github/fleet/deps.toml` and the root `[workspace.dependencies]`
 at the pin); change them there, not here.

Cargo.toml

@@ -1,6 +1,6 @@
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0
 #
-# RENDERED by `busbar-release plugin sync busbar-auth-github` from GetBusbar/busbar-release template/ and
+# RENDERED by `busbar-release plugin heal busbar-auth-github` from GetBusbar/busbar-release template/ and
 # GetBusbar/busbar's dependency policy; a hand edit is overwritten by the next sync.
 #
 # One repo per plugin, every repo a twin: this workspace is exactly two crates, the logic (the rlib a
@@ -10,8 +10,8 @@
 # `.busbar-ref`; no sibling-checkout path dependency ships in any manifest.
 #
 # THIRD-PARTY VERSIONS ARE THE FLEET'S, NOT THIS REPO'S. The table below is busbar's own root
-# `[workspace.dependencies]` (third-party rows) at busbar 33671357f37a411fd135a2d15cbed3d9947f34f0, followed by the plugin-only rows
-# of busbar's `.github/fleet/deps.toml` at 33671357f37a411fd135a2d15cbed3d9947f34f0. A member takes a crate with
+# `[workspace.dependencies]` (third-party rows) at busbar 41fd7c5f386fa098890c031721f19bfca903f225, followed by the plugin-only rows
+# of busbar's `.github/fleet/deps.toml` at 41fd7c5f386fa098890c031721f19bfca903f225. A member takes a crate with
 # `{ workspace = true }` (adding features if it needs them); a crate in neither table is a new
 # `deps.toml` row in busbar first. CI holds this repo's Cargo.lock to busbar's lock at the pin.
 [workspace]
@@ -24,16 +24,23 @@ members = [
 [workspace.package]
 edition = "2021"
 rust-version = "1.98"
-license = "MIT"
+license = "Apache-2.0"
 publish = false
 repository = "https://github.com/GetBusbar/busbar-auth-github"
 
 [workspace.dependencies]
-busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "33671357f37a411fd135a2d15cbed3d9947f34f0" }
-busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "33671357f37a411fd135a2d15cbed3d9947f34f0" }
-# busbar's root [workspace.dependencies], third-party rows, at 33671357f37a411fd135a2d15cbed3d9947f34f0
+busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "41fd7c5f386fa098890c031721f19bfca903f225" }
+busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "41fd7c5f386fa098890c031721f19bfca903f225" }
+# THE SUITE'S HOST CONNECTOR (dev-only; auth-github-plugin/tests/support/conformance_host.rs,
+# rendered because the declares file states network needs): busbar's connector and its TLS
+# test kit at the pin, and the transport framers those needs name, at the revs busbar links.
+busbar-core-connector = { git = "https://github.com/GetBusbar/busbar", rev = "41fd7c5f386fa098890c031721f19bfca903f225", features = ["test-support"] }
+busbar-transport-http = { git = "https://github.com/GetBusbar/busbar-transport-http", rev = "a715d1ab57dcec469930563da0c0509a4fb75289" }
+busbar-transport-tcp = { git = "https://github.com/GetBusbar/busbar-transport-tcp", rev = "eb334dd6e9d3dcd62ae1616f77a5ed56311b255a" }
+# busbar's root [workspace.dependencies], third-party rows, at 41fd7c5f386fa098890c031721f19bfca903f225
 a2a-lf = "0.3.0"
 a2a-pb = "0.2.0"
+aes = { version = "0.8", default-features = false }
 arc-swap = "1"
 async-trait = "0.1"
 axum = "0.8"
@@ -75,7 +82,6 @@ prost = { version = "0.14", default-features = false, features = ["std"] }
 rcgen = { version = "0.14", default-features = false, features = ["crypto", "ring"] }
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
 ring = "0.17"
-rmcp = { version = "3.1.2", default-features = false }
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 rustls-pki-types = { version = "1", default-features = false, features = ["std"] }
 schemars = "1"
@@ -87,6 +93,7 @@ sha2 = "0.10"
 smallvec = "1"
 socket2 = { version = "0.6", features = ["all"] }
 sonic-rs = "0.5"
+str0m = { version = "=0.24.1", default-features = false }
 syn = { version = "2", features = ["full", "visit", "parsing", "printing"] }
 tar = { version = "0.4", default-features = false }
 tikv-jemalloc-ctl = "0.6"
@@ -107,10 +114,22 @@ url = "2"
 webpki = { package = "rustls-webpki", version = "0.103", default-features = false, features = ["std", "ring"] }
 webpki-roots = "1"
 zeroize = "1"
-# busbar .github/fleet/deps.toml [plugin-deps], at 33671357f37a411fd135a2d15cbed3d9947f34f0
+# busbar .github/fleet/deps.toml [plugin-deps], at 41fd7c5f386fa098890c031721f19bfca903f225
+fallible-iterator = "0.2"
 ldap3 = { version = "0.12", default-features = false, features = ["sync"] }
-mysql = { version = "26", default-features = false, features = ["minimal"] }
+mysql = { version = "28", default-features = false, features = ["minimal-rust"] }
+mysql_common = { version = "0.35", default-features = false }
+percent-encoding = "2"
 postgres = "0.19"
+postgres-protocol = "0.6.11"
+postgres-types = "0.2"
 redis = { version = "1", default-features = false, features = ["script"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
 ulid = "1"
+
+# ONE busbar-contract (the suite's host connector): the transport framers above name
+# busbar-contract at their own revs of busbar; this repo's pin serves them all, as busbar
+# patches them to its own tree. The source is busbar spelled through www.github.com: Cargo
+# refuses a patch that names the source it patches.
+[patch."https://github.com/GetBusbar/busbar"]
+busbar-contract = { git = "https://www.github.com/GetBusbar/busbar", rev = "41fd7c5f386fa098890c031721f19bfca903f225" }