T-3: OAuth App registration + Client ID + entitlement

[kirich1409]

Description

(1) Manual step (owner): register OAuth App at https://github.com/organizations/androidbroadcast/settings/applications

• Application name: Relay
• Homepage URL: https://github.com/androidbroadcast/relay
• Authorization callback URL: relay://oauth/callback
• Device Flow: off
• Obtain Client ID → pass to implementer

(2) Populate GitHubIntegrationClient/GitHubOAuthConfig.swift:

public enum GitHubOAuthConfig {
    public static let clientID = "<real-id-from-user>"
    public static let redirectScheme = "relay"
    public static let redirectURI = "relay://oauth/callback"
    public static let scope = "repo"
}

(3) Add com.apple.security.network.client = true in MacApp/Relay/Relay.entitlements.

(4) Do NOT register the URL scheme in Info.plist (CFBundleURLTypes) — ASWebAuthenticationSession.callbackURLScheme (used in T-7) handles the redirect inside the ephemeral web session without app-wide scheme registration. This is a deliberate deviation flagged by BA review.

Spec reference

See swarm-report/github-integration-decomposition.md#t-3.

Relationships

• Parent issue: EPIC: GitHub Integration MVP (read-only CI status + popover + OAuth) #214
• Blocked by: T-2
• Blocks: T-7
• Related: none

Acceptance criteria

• OAuth App registered in androidbroadcast organization; Client ID obtained
• GitHubOAuthConfig.clientID contains the real Client ID (not placeholder)
• Relay.entitlements contains <key>com.apple.security.network.client</key><true/>
• xcodebuild build green; app launches without entitlement warnings
• Info.plist does NOT contain CFBundleURLTypes for this feature
• Owner confirms OAuth App exists and is active in GitHub org settings

Complexity

S

Suggested agent

developer-workflow:swift-engineer (with a manual OAuth App registration step from the repository owner)

Module / Layer

GitHubIntegrationClient / Config + App target / Entitlements

Notes

Implementation agent may start with a placeholder Client ID; full AC requires the real ID. T-7 integration tests are SKIPPED until this task is fully closed.