fix: bound repository sync concurrency and handle pre-creation suborg lookups

[decyjphr]

Why

Installation-wide sync starts every repository concurrently, creating unnecessary API pressure, and a rejected repository can prevent later reporting and follow-up processing. Separately, smoke phase 7 fails after earlier phases create a team-targeted suborg: membership resolution queries the new repository before force_create has created it.

Approach

• Adapt the missing changes from fix: process repositories in batches to prevent partial sync on large orgs #1029 to yadhav/fix-recent-issues: process installation repositories in batches of ten using Promise.allSettled, preserving successful result values and input order.
• Retain failed repositories in the existing error collection and NOP error results, with repository-specific attribution. Later repositories continue, but apply checks and full-sync exit status still indicate failure. Existing selection, archive, plugin, and result-deduplication paths remain intact.
• Treat a team or custom-property membership 404 as an unmatched selector only when the repository lookup also returns 404. Preserve other API errors and name-based matching; existing re-evaluation applies inherited suborg settings after creation.
• Include the full-sync entrypoint in the Docker image and document both behaviors.

Promise.all does not cancel already-started work. The batching change bounds repository concurrency and waits for each batch to settle before proceeding; it does not impose a global limit on individual plugin API calls.

Validation

Using Node 22.12.0:

• npm run test:unit -- --runInBand --silent --reporters=default: 511 passed, 12 skipped; 24 suites passed, 2 skipped. Includes 35 new regression cases for measured concurrency, final partial batches, result ordering, failure reporting, restrictions, and new-repository suborg resolution in apply/NOP modes.
• A live GET-only probe against the historical failed phase-7 PR configuration now resolves membership without NOP or logged errors. No external resources were modified.
• Full-sync subprocess checks verified exit 0 without errors and exit 1 with retained repository errors in both apply and NOP modes. Docker entrypoint COPY assertion passed.
• New test files pass ESLint and Standard. lib/settings.js retains exactly seven pre-existing trailing-whitespace diagnostics; git diff --check passes.

Validation limits

• Integration tests fail before execution in all seven suites because unchanged test/integration/common.js requires ESM Probot (Unexpected token 'export').
• No full live smoke rerun: four pre-existing fixed-name smoke branches remain without cleanup authorization. Setup and cleanup were not run.
• Docker image build was not run because the Docker daemon is unavailable.

Targets yadhav/fix-recent-issues; no wholesale merge from main-enterprise.

[Copilot]

Copilot review overview

🟡 Changes recommended

Resolve the two moderate error-recording and failure-reporting issues in lib/settings.js.

Review effort: Lite
Findings: 1

Open (1)

• Record repository failures in NOP mode to preserve sync errors · New

What changed in this PR

This pull request bounds repository sync concurrency and handles suborg membership lookups before repository creation. Two unresolved moderate issues remain in lib/settings.js around NOP error attribution and full-sync failure reporting.

Changes:

• Processes repositories in batches of ten with Promise.allSettled.
• Adds deferred membership handling for missing repositories.
• Adds full-sync Docker support and documentation.

File	Summary
test/​unit/​lib/​settings-new-repo.test.js	Tests pre-creation membership resolution.
test/​unit/​lib/​settings-batching.test.js	Tests batching and failure behavior.
README.md	Documents pre-creation suborg behavior.
lib/​settings.js	Implements batching, membership handling, and error aggregation.
docs/​github-action.md	Documents batching and failure reporting.
docs/​docker-debugging.md	Documents Docker full-sync usage.
Dockerfile	Includes the full-sync entrypoint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.