[utsab345]

Description

Implements #3193: moves the PyGithub pin from ==1.59.* to >=2.10,<3 and migrates the two call sites (plus the import) that use APIs PyGithub deprecated back in the 1.59 era.

1. Migrated call sites. Per the issue scope, the change touches exactly the three locations already identified:
   • pr_agent/git_providers/github_provider.py:14 drops the AppAuthentication import (no longer referenced after the migration).
   • GithubIntegration(integration_id=..., private_key=..., base_url=...) now passes auth=Auth.AppAuth(app_id=..., private_key=...) on the app-JWT path, with base_url unchanged.
   • AppAuthentication(app_id=..., private_key=..., installation_id=...) now uses Auth.AppInstallationAuth(Auth.AppAuth(...), installation_id=...) on the installation-token path, so provider.auth._app_auth stays the wrapped AppAuth that test_github_app_auth.py relies on for JWT creation.
2. Pin. PyGithub>=2.10,<3; the lockfile diff is limited to the PyGithub version/hashes.
3. Framing. This is deprecation cleanup ahead of PyGithub 3.x, not a fix for anything currently broken. Both deprecated forms still work on 2.10, but they raise DeprecationWarning from the app-auth path.
4. Auth migration pinned by tests. The GithubIntegration stubs in test_review_persistent_comment_authorship.py now capture and assert that the new auth kwarg is an Auth.AppAuth, so the migration cannot silently regress to the deprecated constructor.
5. Pacing and retries are a choice, not a surprise. PyGithub 2.x turns on request pacing and automatic retries by default (0.25s between requests, 1s between writes, 10 retries), behaviour 1.59 did not have. The [github] settings now mirror the 1.59 behaviour (seconds_between_requests = 0, seconds_between_writes = 0, api_retries = 0) and _get_github_client passes them to the Github(...) constructor explicitly, so the upgrade stays behaviour neutral unless an operator opts in. The app-auth docstring in test_github_app_auth.py and the str() comment in the provider were refreshed to match 2.x behaviour: PyGithub#3272 landed in 2.7.0, so the cast is now a harmless guarantee rather than the load-bearing requirement it was on 1.59.

Why this is the right replacement shape

The Auth.AppAuth swap alone would be correct at the GithubIntegration site (the app JWT needed for GET /app), but the deployment path issues an installation-scoped token, so it needs Auth.AppInstallationAuth wrapping Auth.AppAuth. Auth.AppAuth alone would not work there, a correction to the issue's original suggestion.

Verification

1. tests/unittest/test_github_app_auth.py, tests/unittest/test_review_persistent_comment_authorship.py and tests/unittest/test_github_provider_import.py pass on the 2.10.0 pin.
2. Running those tests with -W error::DeprecationWarning:github produces no github-module deprecation warnings, confirming the old auth path is gone from our call sites.
3. Full unit suite: 4452 passed, 1 skipped, 1 xfailed. The baseline on main is 4450; the two new tests cover the client pacing defaults (no pacing, no retries) and the configurable overrides flowing into the constructor. The app-related e2e path still requires the GitHub App credentials as noted in the issue.

closes #3193

[IsmaelMartinez]

The new auth path holds up against real PyGithub 2.10.0, so this is close. One ask here, two inline.

Nothing asserts the new auth= kwarg. The GithubIntegration stubs in test_review_persistent_comment_authorship.py, at lines 371 and 393, are def integration(**kwargs), so they pass either way: I reverted the call site to the old integration_id= form and all twelve tests in that file stayed green. Capturing and asserting the kwarg would pin the migration.

[qodo-code-review]

Code Review by Qodo

Sorry, something went wrong

We weren't able to complete the code review on our side. Please try again manually by commenting /agentic_review on this PR.

[utsab345]

Pushed 291c8f9 addressing the review:

• The GithubIntegration stubs in test_review_persistent_comment_authorship.py now capture and assert the auth kwarg is an Auth.AppAuth, so the migration is pinned by tests (the two stubs were **kwargs, so either form passed before).
• The docstring in test_github_app_auth.py is updated: PyGithub#3272 landed in 2.7.0, so the 2.10 pin already ships the native integer to string iss conversion, and the str() cast is now a harmless guarantee. The provider comment at github_provider.py was refreshed to match.
• On pacing and retries: PyGithub 2.x defaults to 0.25s between requests, 1s between writes and GithubRetry(total=10), none of which 1.59 had. The client now applies explicit [github] settings that mirror the 1.59 behaviour (seconds_between_requests = 0, seconds_between_writes = 0, api_retries = 0), so the upgrade stays behaviour neutral unless an operator opts in. Two tests cover both the defaults and the overrides reaching the Github(...) constructor.

Full unit suite: 4452 passed, 1 skipped, 1 xfailed (4450 on main plus the two new tests).

[IsmaelMartinez]

Thanks for pinning the auth kwarg in the stubs rather than only changing the call site. Approving.

Reverting the call site to integration_id= now turns two of the twelve tests in that file red, where all twelve stayed green before, so the migration is held in place.

On pacing I re-measured against real PyGithub 2.10.0: stock defaults come out at 0.25s, 1.0s and GithubRetry(total=10), and the client this branch builds comes out at 0, 0 and None. Neutral against 1.59, with the opt-in documented in the section. Worth naming what the zero default gives up: retry=None declines 2.x's secondary rate limit backoff on writes, and pr-agent only retries _get_diff_files.

Suite 4458 against a 4456 baseline on today's main.