Refactor GitHub provider to use Config pattern

Replace Params with Config to encapsulate BaseURL + Token + Timeout
together, addressing review feedback about HTTPClient encapsulation.

Changes:
- Add Config type with BaseURL, Token, Timeout, and optional HTTPClient
- Derive GraphQL URL from BaseURL (no separate parameter needed)
- Add configurable timeout (defaults to 30s)
- Simplify main.go to use DefaultConfig()
- Update all tests to use Config instead of Params

Benefits:
- Impossible to misconfigure (URL and auth bundled)
- Multi-instance support (github.com + GHE)
- Flexible timeout per instance
- Cleaner API surface

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rashmi-prithyani

example/server/orchestrator/main.go

@@ -448,25 +448,10 @@ func newMergeChecker(logger *zap.Logger, scope tally.Scope) mergechecker.MergeCh
 }
 
 // newChangeProvider creates a ChangeProvider for GitHub (github.com).
-// Configured via GITHUB_TOKEN and GITHUB_GRAPHQL_URL environment variables.
-// Reuses the same HTTP client configuration as the mergechecker.
+// Configured via GITHUB_BASE_URL and GITHUB_TOKEN environment variables.
 func newChangeProvider(logger *zap.Logger, scope tally.Scope) changeprovider.ChangeProvider {
-	graphQLURL := os.Getenv("GITHUB_GRAPHQL_URL")
-	if graphQLURL == "" {
-		graphQLURL = "https://api.github.com/graphql"
-	}
-
-	httpClient := &http.Client{}
-	if token := os.Getenv("GITHUB_TOKEN"); token != "" {
-		httpClient.Transport = &bearerTransport{token: token}
-	}
-
-	return githubprovider.NewProvider(githubprovider.Params{
-		HTTPClient:   httpClient,
-		GraphQLURL:   graphQLURL,
-		Logger:       logger.Sugar(),
-		MetricsScope: scope.SubScope("changeprovider"),
-	})
+	config := githubprovider.DefaultConfig()
+	return githubprovider.NewProvider(config, logger.Sugar(), scope.SubScope("changeprovider"))
 }
 
 // bearerTransport is an http.RoundTripper that adds a Bearer token to requests.

extension/changeprovider/github/BUILD.bazel

@@ -3,6 +3,7 @@ load("@rules_go//go:def.bzl", "go_library", "go_test")
 go_library(
     name = "github",
     srcs = [
+        "config.go",
         "convert.go",
         "graphql.go",
         "provider.go",

extension/changeprovider/github/config.go

@@ -0,0 +1,59 @@
+package github
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+)
+
+const (
+	// DefaultTimeout is the default HTTP request timeout for GitHub API calls.
+	// This applies to the entire request/response cycle.
+	DefaultTimeout = 30 * time.Second
+)
+
+// Config holds configuration for connecting to a GitHub backend.
+type Config struct {
+	// BaseURL is the GitHub instance base URL (without /graphql suffix).
+	// Examples: "https://api.github.com", "https://ghe.company.com"
+	BaseURL string
+
+	// Token for authenticating to this GitHub instance.
+	// Can be empty for unauthenticated requests.
+	Token string
+
+	// Timeout for HTTP requests to this GitHub instance.
+	// If zero or negative, defaults to DefaultTimeout (30s).
+	// Set this higher for slow GHE instances or flaky networks.
+	Timeout time.Duration
+
+	// HTTPClient provides complete control over the HTTP client.
+	// If set, BaseURL is still used but Token and Timeout are ignored.
+	// Use this for custom transports, connection pooling, or testing.
+	HTTPClient *http.Client
+}
+
+// Validate checks if the config is valid.
+func (c Config) Validate() error {
+	if c.BaseURL == "" {
+		return fmt.Errorf("BaseURL is required")
+	}
+	return nil
+}
+
+// DefaultConfig returns a Config for github.com from environment.
+func DefaultConfig() Config {
+	return Config{
+		BaseURL: getEnvOrDefault("GITHUB_BASE_URL", "https://api.github.com"),
+		Token:   os.Getenv("GITHUB_TOKEN"),
+		Timeout: 0, // Will use DefaultTimeout
+	}
+}
+
+func getEnvOrDefault(key, defaultVal string) string {
+	if val := os.Getenv(key); val != "" {
+		return val
+	}
+	return defaultVal
+}

extension/changeprovider/github/provider.go

@@ -15,20 +15,6 @@ import (
 	"github.com/uber/submitqueue/extension/changeprovider"
 )
 
-// Params holds the dependencies for the GitHub ChangeProvider.
-type Params struct {
-	// HTTPClient is a pre-configured HTTP client with auth (bearer token, GitHub App JWT, etc.).
-	// Auth is the caller's responsibility via HTTP transport/round-tripper.
-	HTTPClient *http.Client
-	// GraphQLURL is the GitHub GraphQL API endpoint
-	// (e.g., "https://api.github.com/graphql" or "https://ghe.example.com/api/graphql").
-	GraphQLURL string
-	// Logger is the structured logger.
-	Logger *zap.SugaredLogger
-	// MetricsScope is the metrics scope for instrumentation.
-	MetricsScope tally.Scope
-}
-
 // provider implements the ChangeProvider interface for GitHub.
 type provider struct {
 	httpClient *http.Client
@@ -37,14 +23,67 @@ type provider struct {
 	metrics    tally.Scope
 }
 
-// NewProvider creates a new GitHub ChangeProvider.
-func NewProvider(params Params) changeprovider.ChangeProvider {
+// NewProvider creates a new GitHub ChangeProvider from configuration.
+func NewProvider(config Config, logger *zap.SugaredLogger, metrics tally.Scope) changeprovider.ChangeProvider {
+	if err := config.Validate(); err != nil {
+		panic(fmt.Sprintf("invalid GitHub config: %v", err))
+	}
+
+	// Derive GraphQL URL from base URL
+	graphQLURL := config.BaseURL + "/graphql"
+
+	// Use provided client or create default
+	httpClient := config.HTTPClient
+	if httpClient == nil {
+		timeout := config.Timeout
+		if timeout <= 0 {
+			timeout = DefaultTimeout
+		}
+		httpClient = createDefaultClient(config.Token, timeout)
+	}
+
 	return &provider{
-		httpClient: params.HTTPClient,
-		graphQLURL: params.GraphQLURL,
-		logger:     params.Logger.Named("github_changeprovider"),
-		metrics:    params.MetricsScope.SubScope("github_changeprovider"),
+		httpClient: httpClient,
+		graphQLURL: graphQLURL,
+		logger:     logger.Named("github_changeprovider"),
+		metrics:    metrics.SubScope("github_changeprovider"),
+	}
+}
+
+// createDefaultClient creates an HTTP client with the given token and timeout.
+func createDefaultClient(token string, timeout time.Duration) *http.Client {
+	transport := createTransport(token)
+
+	return &http.Client{
+		Timeout:   timeout,
+		Transport: transport,
+	}
+}
+
+// createTransport creates an HTTP transport with optional bearer token authentication.
+func createTransport(token string) http.RoundTripper {
+	base := http.DefaultTransport
+
+	if token == "" {
+		return base
 	}
+
+	return &bearerTransport{
+		token: token,
+		base:  base,
+	}
+}
+
+// bearerTransport is an http.RoundTripper that adds a Bearer token to requests.
+type bearerTransport struct {
+	token string
+	base  http.RoundTripper
+}
+
+func (t *bearerTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	req.Header.Set("Authorization", "Bearer "+t.token)
+	return t.base.RoundTrip(req)
 }
 
 // Get retrieves change information from GitHub for the provided Change.