feat(entities): Implement ENTITY_ORGANIZATION for Github Providers

cmd/server/app/backfill_organizations.go

@@ -0,0 +1,86 @@
+// SPDX-FileCopyrightText: Copyright 2026 The Minder Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package app
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"github.com/mindersec/minder/internal/db"
+	"github.com/mindersec/minder/pkg/entities/properties"
+)
+
+func backfillOrganizations(ctx context.Context, store db.Store) error {
+	l := zerolog.Ctx(ctx)
+	l.Info().Msg("Starting backfill for Organization entities...")
+
+	provs, err := store.GlobalListProvidersByClass(ctx, db.ProviderClassGithubApp)
+	if err != nil {
+		return fmt.Errorf("failed to list providers: %w", err)
+	}
+
+	count := 0
+
+	for _, prov := range provs {
+		login := strings.TrimPrefix(prov.Name, string(db.ProviderClassGithubApp)+"-")
+
+		_, err = db.WithTransaction(store, func(qtx db.ExtendQuerier) (any, error) {
+			// Check if organization entity already exists
+			_, err := qtx.GetEntityByName(ctx, db.GetEntityByNameParams{
+				EntityType: db.EntitiesOrganization,
+				Name:       login,
+				ProviderID: prov.ID,
+				ProjectID:  prov.ProjectID,
+			})
+
+			if err == nil {
+				return nil, nil // already exists
+			} else if !errors.Is(err, sql.ErrNoRows) {
+				return nil, err
+			}
+
+			// Entity doesn't exist, create it
+			ent, err := qtx.CreateEntity(ctx, db.CreateEntityParams{
+				EntityType: db.EntitiesOrganization,
+				Name:       login,
+				ProviderID: prov.ID,
+				ProjectID:  prov.ProjectID,
+			})
+			if err != nil {
+				return nil, err
+			}
+
+			// Set the default property (login name)
+			propVal := map[string]any{
+				"minder.internal.type":  "string",
+				"minder.internal.value": login,
+			}
+			propBytes, _ := json.Marshal(propVal)
+
+			_, err = qtx.UpsertProperty(ctx, db.UpsertPropertyParams{
+				EntityID: ent.ID,
+				Key:      properties.PropertyName,
+				Value:    propBytes,
+			})
+
+			if err == nil {
+				count++
+			}
+			return nil, err
+		})
+
+		if err != nil {
+			l.Error().Err(err).Str("provider", prov.ID.String()).Msg("Failed to backfill organization for provider")
+		}
+	}
+
+	l.Info().Int("count", count).Msg("Completed backfill for Organization entities")
+	return nil
+}

cmd/server/app/migrate_up.go

@@ -18,6 +18,7 @@ import (
 
 	"github.com/mindersec/minder/database"
 	"github.com/mindersec/minder/internal/authz"
+	"github.com/mindersec/minder/internal/db"
 	"github.com/mindersec/minder/pkg/config"
 	serverconfig "github.com/mindersec/minder/pkg/config/server"
 )
@@ -98,6 +99,11 @@ var upCmd = &cobra.Command{
 			return fmt.Errorf("error preparing authz client: %w", err)
 		}
 
+		cmd.Println("Backfilling organizations...")
+		if err := backfillOrganizations(ctx, db.NewStore(dbConn)); err != nil {
+			return fmt.Errorf("error while backfilling organizations: %w", err)
+		}
+
 		return nil
 	},
 }

database/migrations/000117_organization_entity.down.sql

@@ -0,0 +1,4 @@
+-- SPDX-FileCopyrightText: Copyright 2026 The Minder Authors
+-- SPDX-License-Identifier: Apache-2.0
+
+-- Postgres doesn't easily drop enum values, down migration is a no-op

database/migrations/000117_organization_entity.up.sql

@@ -0,0 +1,4 @@
+-- SPDX-FileCopyrightText: Copyright 2026 The Minder Authors
+-- SPDX-License-Identifier: Apache-2.0
+
+ALTER TYPE entities ADD VALUE 'organization';

internal/controlplane/handlers_entities.go

@@ -127,3 +127,34 @@ func createEntityMessage(
 
 	return msg, nil
 }
+
+func (s *Server) publishOrganizationEntityEvent(
+	ctx context.Context,
+	providerID, projectID uuid.UUID,
+	login string,
+) {
+	l := zerolog.Ctx(ctx)
+	msg := message.NewMessage(uuid.New().String(), nil)
+	msg.SetContext(ctx)
+
+	orgProps := properties.NewProperties(map[string]any{
+		properties.PropertyName: login,
+	})
+
+	event := messages.NewMinderEvent().
+		WithProjectID(projectID).
+		WithProviderID(providerID).
+		WithEntityType(pb.Entity_ENTITY_ORGANIZATION).
+		WithProperties(orgProps)
+
+	if err := event.ToMessage(msg); err != nil {
+		l.Error().Err(err).Msg("error marshalling organization entity event")
+		return
+	}
+
+	if err := s.evt.Publish(constants.TopicQueueReconcileEntityAdd, msg); err != nil {
+		l.Error().Err(err).Msg("error publishing organization entity event")
+	} else {
+		l.Info().Str("messageID", msg.UUID).Msg("published organization entity event for execution")
+	}
+}

internal/controlplane/handlers_evalstatus.go

@@ -768,6 +768,8 @@ func dbEntityToEntity(dbEnt db.Entities) minderv1.Entity {
 	switch dbEnt {
 	case db.EntitiesPullRequest:
 		return minderv1.Entity_ENTITY_PULL_REQUESTS
+	case db.EntitiesOrganization:
+		return minderv1.Entity_ENTITY_ORGANIZATION
 	case db.EntitiesArtifact:
 		return minderv1.Entity_ENTITY_ARTIFACTS
 	case db.EntitiesRepository:

internal/controlplane/handlers_oauth.go

@@ -436,18 +436,14 @@ func (s *Server) processAppCallback(ctx context.Context, w http.ResponseWriter,
 
 		logger.BusinessRecord(ctx).Project = stateData.ProjectID
 
-		var confErr providers.ErrProviderInvalidConfig
-		_, err = s.ghProviders.CreateGitHubAppProvider(ctx, *token, stateData, installationID, state)
+		dbProv, err := s.ghProviders.CreateGitHubAppProvider(ctx, *token, stateData, installationID, state)
 		if err != nil {
-			if errors.As(err, &confErr) {
-				return newHttpError(http.StatusBadRequest, "Invalid provider config").SetContents(
-					"The provider configuration is invalid: %s", confErr.Details)
-			}
-			if errors.Is(err, service.ErrInvalidTokenIdentity) {
-				return newHttpError(http.StatusForbidden, "User token mismatch").SetContents(
-					"The provided login token was associated with a different GitHub user.")
-			}
-			return fmt.Errorf("error creating GitHub App provider: %w", err)
+			return handleProviderCreationError(err)
+		}
+
+		if dbProv != nil {
+			login := strings.TrimPrefix(dbProv.Name, string(db.ProviderClassGithubApp)+"-")
+			s.publishOrganizationEntityEvent(ctx, dbProv.ID, dbProv.ProjectID, login)
 		}
 
 		if stateData.RedirectUrl.Valid || stateData.EncryptedRedirect.Valid {
@@ -541,7 +537,17 @@ func (s *Server) handleAppInstallWithoutInvite(ctx context.Context, token *oauth
 	}
 
 	_, err = db.WithTransaction(s.store, func(qtx db.ExtendQuerier) (*db.Project, error) {
-		return s.ghProviders.CreateGitHubAppWithoutInvitation(ctx, qtx, *userID, installationID)
+		proj, dbProv, err := s.ghProviders.CreateGitHubAppWithoutInvitation(ctx, qtx, *userID, installationID)
+		if err != nil {
+			return nil, err
+		}
+		if dbProv != nil && proj != nil {
+			login := strings.TrimPrefix(dbProv.Name, string(db.ProviderClassGithubApp)+"-")
+			// It is generally safe to publish an event from within a transaction, as long
+			// as the event handler evaluates the state matching later.
+			s.publishOrganizationEntityEvent(ctx, dbProv.ID, proj.ID, login)
+		}
+		return proj, nil
 	})
 	return err
 }
@@ -787,3 +793,16 @@ func (s *Server) decryptRedirect(stateData *db.GetProjectIDBySessionStateRow) (*
 	}
 	return parsedURL, nil
 }
+
+func handleProviderCreationError(err error) error {
+	var confErr providers.ErrProviderInvalidConfig
+	if errors.As(err, &confErr) {
+		return newHttpError(http.StatusBadRequest, "Invalid provider config").SetContents(
+			"The provider configuration is invalid: %s", confErr.Details)
+	}
+	if errors.Is(err, service.ErrInvalidTokenIdentity) {
+		return newHttpError(http.StatusForbidden, "User token mismatch").SetContents(
+			"The provided login token was associated with a different GitHub user.")
+	}
+	return fmt.Errorf("error creating GitHub App provider: %w", err)
+}

internal/controlplane/handlers_oauth_test.go

@@ -851,7 +851,7 @@ func TestHandleGitHubAppCallback(t *testing.T) {
 				db.EXPECT().Rollback(gomock.Any()).Return(nil)
 				service.EXPECT().
 					CreateGitHubAppWithoutInvitation(gomock.Any(), gomock.Any(), userId, installationID).
-					Return(nil, nil)
+					Return(nil, nil, nil)
 			},
 			checkResponse: func(t *testing.T, resp httptest.ResponseRecorder) {
 				t.Helper()

internal/controlplane/handlers_profile.go

@@ -427,7 +427,7 @@ func (s *Server) getRuleEvalStatus(
 				repoPath = fmt.Sprintf("%s/%s", prRepoOwner, prRepoName)
 			}
 		case db.EntitiesBuildEnvironment, db.EntitiesRelease, db.EntitiesPipelineRun,
-			db.EntitiesTaskRun, db.EntitiesBuild:
+			db.EntitiesTaskRun, db.EntitiesBuild, db.EntitiesOrganization:
 			zerolog.Ctx(ctx).Warn().Msgf("attempting to set alerts for unsupported entity type: %v", dbRuleEvalStat.EntityType)
 		default:
 			zerolog.Ctx(ctx).Error().Msgf("unknown entity type: %v", dbRuleEvalStat.EntityType)

internal/controlplane/handlers_user.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"path"
 	"strconv"
+	"strings"
 
 	"github.com/google/uuid"
 	gauth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
@@ -134,11 +135,15 @@ func (s *Server) claimGitHubInstalls(ctx context.Context, qtx db.ExtendQuerier)
 
 	for _, i := range installs {
 		// TODO: if we can get an GitHub auth token for the user, we can do the rest with CreateGitHubAppWithoutInvitation
-		proj, err := s.ghProviders.CreateGitHubAppWithoutInvitation(ctx, qtx, userID, i.AppInstallationID)
+		proj, dbProv, err := s.ghProviders.CreateGitHubAppWithoutInvitation(ctx, qtx, userID, i.AppInstallationID)
 		if err != nil {
 			zerolog.Ctx(ctx).Error().Err(err).Int64("org_id", i.OrganizationID).Msg("failed to create GitHub app at first login")
 			continue
 		}
+		if dbProv != nil {
+			login := strings.TrimPrefix(dbProv.Name, string(db.ProviderClassGithubApp)+"-")
+			s.publishOrganizationEntityEvent(ctx, dbProv.ID, proj.ID, login)
+		}
 		if proj != nil {
 			userProjects = append(userProjects, proj)
 		}

internal/controlplane/handlers_user_test.go

@@ -145,7 +145,7 @@ func TestCreateUser_gRPC(t *testing.T) {
 					Return(&db.Project{
 						ID:   projectID,
 						Name: "github-org1",
-					}, nil)
+					}, nil, nil)
 
 				store.EXPECT().Commit(gomock.Any())
 				store.EXPECT().Rollback(gomock.Any())
@@ -206,14 +206,14 @@ func TestCreateUser_gRPC(t *testing.T) {
 					Return(&db.Project{
 						ID:   projectID,
 						Name: "github-org1",
-					}, nil)
+					}, nil, nil)
 
 				prov.EXPECT().
 					CreateGitHubAppWithoutInvitation(gomock.Any(), gomock.Any(), int64(31337), int64(11)).
 					Return(&db.Project{
 						ID:   uuid.New(),
 						Name: "github-org2",
-					}, nil)
+					}, nil, nil)
 
 				store.EXPECT().Commit(gomock.Any())
 				store.EXPECT().Rollback(gomock.Any())

internal/eea/eea.go

@@ -255,7 +255,7 @@ func (e *EEA) buildEntityWrapper(
 	case db.EntitiesPullRequest:
 		return e.buildPullRequestInfoWrapper(ctx, entityID, projID)
 	case db.EntitiesBuildEnvironment, db.EntitiesRelease,
-		db.EntitiesPipelineRun, db.EntitiesTaskRun, db.EntitiesBuild:
+		db.EntitiesPipelineRun, db.EntitiesTaskRun, db.EntitiesBuild, db.EntitiesOrganization:
 		return nil, fmt.Errorf("entity type %q not yet supported", entity)
 	default:
 		return nil, fmt.Errorf("unknown entity type: %q", entity)

internal/engine/entities/entities.go

@@ -50,6 +50,8 @@ func EntityTypeFromDB(entity db.Entities) minderv1.Entity {
 		return minderv1.Entity_ENTITY_PIPELINE_RUN
 	case db.EntitiesTaskRun:
 		return minderv1.Entity_ENTITY_TASK_RUN
+	case db.EntitiesOrganization:
+		return minderv1.Entity_ENTITY_ORGANIZATION
 	case db.EntitiesBuild:
 		return minderv1.Entity_ENTITY_BUILD
 	default:
@@ -76,6 +78,8 @@ func EntityTypeToDB(entity minderv1.Entity) db.Entities {
 		dbEnt = db.EntitiesPipelineRun
 	case minderv1.Entity_ENTITY_TASK_RUN:
 		dbEnt = db.EntitiesTaskRun
+	case minderv1.Entity_ENTITY_ORGANIZATION:
+		dbEnt = db.EntitiesOrganization
 	case minderv1.Entity_ENTITY_BUILD:
 		dbEnt = db.EntitiesBuild
 	case minderv1.Entity_ENTITY_UNSPECIFIED:

internal/engine/entities/entity_type_conversion.go

@@ -28,6 +28,8 @@ func EntityTypeToDBType(entityType pb.Entity) (db.Entities, error) {
 		return db.EntitiesPipelineRun, nil
 	case pb.Entity_ENTITY_TASK_RUN:
 		return db.EntitiesTaskRun, nil
+	case pb.Entity_ENTITY_ORGANIZATION:
+		return db.EntitiesOrganization, nil
 	case pb.Entity_ENTITY_BUILD:
 		return db.EntitiesBuild, nil
 	case pb.Entity_ENTITY_UNSPECIFIED:

internal/entities/service/validators/organization.go

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: Copyright 2026 The Minder Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package validators
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+
+	"github.com/mindersec/minder/pkg/entities/properties"
+)
+
+// OrganizationValidator validates organization entity creation
+type OrganizationValidator struct{}
+
+// NewOrganizationValidator creates a new OrganizationValidator
+func NewOrganizationValidator() *OrganizationValidator {
+	return &OrganizationValidator{}
+}
+
+// Validate checks if an organization entity can be created
+func (*OrganizationValidator) Validate(
+	_ context.Context,
+	_ *properties.Properties,
+	_ uuid.UUID,
+) error {
+	// For now, any organization properties that make it this far are valid
+	return nil
+}

internal/logger/telemetry_store_watermill.go

@@ -82,7 +82,7 @@ func newTelemetryStoreFromEntity(inf *entities.EntityInfoWrapper) (*TelemetrySto
 		ts.PullRequest = ent
 	case minderv1.Entity_ENTITY_BUILD_ENVIRONMENTS,
 		minderv1.Entity_ENTITY_RELEASE, minderv1.Entity_ENTITY_PIPELINE_RUN,
-		minderv1.Entity_ENTITY_TASK_RUN, minderv1.Entity_ENTITY_BUILD:
+		minderv1.Entity_ENTITY_TASK_RUN, minderv1.Entity_ENTITY_BUILD, minderv1.Entity_ENTITY_ORGANIZATION:
 		// Noop, see https://github.com/mindersec/minder/issues/3838
 	case minderv1.Entity_ENTITY_UNSPECIFIED:
 		// Do nothing

internal/providers/github/entities.go

@@ -82,6 +82,8 @@ func (c *GitHub) RegisterEntity(
 	case minderv1.Entity_ENTITY_ARTIFACTS:
 		fallthrough
 	case minderv1.Entity_ENTITY_RELEASE:
+		fallthrough
+	case minderv1.Entity_ENTITY_ORGANIZATION:
 		// Nothing to do, accept:
 		return props, nil
 	case minderv1.Entity_ENTITY_REPOSITORIES: