Repair main golangci-lint SA1019 baseline (trait-profile deprecations)

pkg/connector/api_token.go

@@ -26,8 +26,12 @@ func apiTokenResource(ctx context.Context, token *github.PersonalAccessToken) (*
 		options = append(options, resourceSdk.WithSecretLastUsedAt(token.TokenLastUsedAt.Time))
 	}
 
+	// created_at has moved from SecretTrait to a Resource-level attribute, so
+	// set it via the resource-level option instead of the deprecated
+	// WithSecretCreatedAt trait option.
+	var resourceOpts []resourceSdk.ResourceOption
 	if token.AccessGrantedAt != nil {
-		options = append(options, resourceSdk.WithSecretCreatedAt(token.AccessGrantedAt.Time))
+		resourceOpts = append(resourceOpts, resourceSdk.WithResourceCreatedAt(token.AccessGrantedAt.Time))
 	}
 
 	if token.TokenExpiresAt != nil {
@@ -38,6 +42,7 @@ func apiTokenResource(ctx context.Context, token *github.PersonalAccessToken) (*
 		resourceTypeApiToken,
 		token.GetID(),
 		options,
+		resourceOpts...,
 	)
 	if err != nil {
 		return nil, err

pkg/connector/app.go

@@ -39,7 +39,9 @@ func appResource(ctx context.Context, installation *github.Installation, parentR
 
 	opts := []resourceSdk.ResourceOption{
 		resourceSdk.WithParentResourceID(parentResourceID),
-		resourceSdk.WithAppTrait(resourceSdk.WithAppProfile(profile)),
+		resourceSdk.WithAppTrait(),
+		// profile has moved from AppTrait to a Resource-level attribute.
+		resourceSdk.WithResourceProfile(profile),
 		resourceSdk.WithNHIType(v2.NonHumanIdentityTrait_NHI_TYPE_APP_REGISTRATION, "github.app"),
 	}
 	if installation.HTMLURL != nil {

pkg/connector/app_test.go

@@ -36,12 +36,14 @@ func TestAppResource(t *testing.T) {
 	require.Equal(t, v2.NonHumanIdentityTrait_NHI_TYPE_APP_REGISTRATION, nhi.GetNhiType())
 	require.Equal(t, "github.app", nhi.GetNhiDetail())
 
-	app, err := resourceSdk.GetAppTrait(resource)
+	_, err = resourceSdk.GetAppTrait(resource)
 	require.NoError(t, err)
-	appID, ok := resourceSdk.GetProfileInt64Value(app.GetProfile(), "app_id")
+	// profile is now a Resource-level attribute; read it via GetProfile.
+	profile := resourceSdk.GetProfile(resource)
+	appID, ok := resourceSdk.GetProfileInt64Value(profile, "app_id")
 	require.True(t, ok)
 	require.Equal(t, int64(7), appID)
-	login, ok := resourceSdk.GetProfileStringValue(app.GetProfile(), "account_login")
+	login, ok := resourceSdk.GetProfileStringValue(profile, "account_login")
 	require.True(t, ok)
 	require.Equal(t, "acme", login)
 }

pkg/connector/invitation.go

@@ -64,10 +64,19 @@ func invitationToUserResource(invitation *github.Invitation, status string) (*v2
 		invitation.GetID(),
 		[]resourceSdk.UserTraitOption{
 			resourceSdk.WithEmail(invitation.GetEmail(), true),
-			resourceSdk.WithUserProfile(profile),
+			// An invitation is a pending/expired user that must not be
+			// reported as enabled. WithResourceStatus cannot express this:
+			// NewUserTrait force-defaults an unset trait status to ENABLED, so
+			// migrating this line would flip the emitted status from
+			// UNSPECIFIED to ENABLED. Keep the deprecated trait option (which
+			// also mirrors UNSPECIFIED to the resource level) to preserve the
+			// exact status semantics.
+			//nolint:staticcheck // deliberate: WithResourceStatus would force the trait status to ENABLED; UNSPECIFIED must be preserved for invitations.
 			resourceSdk.WithStatus(v2.UserTrait_Status_STATUS_UNSPECIFIED),
 			resourceSdk.WithUserLogin(login),
 		},
+		// profile has moved from UserTrait to a Resource-level attribute.
+		resourceSdk.WithResourceProfile(profile),
 	)
 	if err != nil {
 		return nil, err

pkg/connector/invitation_test.go

@@ -257,6 +257,8 @@ func invitationProfile(t *testing.T, r *v2.Resource) map[string]any {
 	ut, err := resourceSdk.GetUserTrait(r)
 	require.NoError(t, err)
 	require.NotNil(t, ut)
-	require.NotNil(t, ut.Profile)
-	return ut.Profile.AsMap()
+	// profile is now a Resource-level attribute; read it via GetProfile.
+	profile := resourceSdk.GetProfile(r)
+	require.NotNil(t, profile)
+	return profile.AsMap()
 }

pkg/connector/org_role.go

@@ -53,9 +53,9 @@ func orgRoleResource(
 		role.Name,
 		resourceTypeOrgRole,
 		role.ID,
-		[]resourceSdk.RoleTraitOption{
-			resourceSdk.WithRoleProfile(profile),
-		},
+		[]resourceSdk.RoleTraitOption{},
+		// profile has moved from RoleTrait to a Resource-level attribute.
+		resourceSdk.WithResourceProfile(profile),
 		resourceSdk.WithParentResourceID(org.Id),
 		resourceSdk.WithAnnotation(
 			&v2.V1Identifier{Id: fmt.Sprintf("org_role:%d", role.ID)},

pkg/connector/team.go

@@ -45,7 +45,9 @@ func teamResource(team *github.Team, orgID int64, parentResourceID *v2.ResourceI
 		team.GetName(),
 		resourceTypeTeam,
 		team.GetID(),
-		[]rType.GroupTraitOption{rType.WithGroupProfile(profile)},
+		[]rType.GroupTraitOption{},
+		// profile has moved from GroupTrait to a Resource-level attribute.
+		rType.WithResourceProfile(profile),
 		rType.WithAnnotation(
 			&v2.ExternalLink{Url: team.GetURL()},
 			&v2.V1Identifier{Id: fmt.Sprintf("team:%d", team.GetID())},
@@ -159,12 +161,10 @@ func (o *teamResourceType) Grants(ctx context.Context, resource *v2.Resource, op
 		return nil, nil, err
 	}
 
-	teamTrait, err := rType.GetGroupTrait(resource)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	orgID, ok := rType.GetProfileInt64Value(teamTrait.Profile, "orgID")
+	// profile has moved from GroupTrait to a Resource-level attribute; read it
+	// via GetProfile, which resolves the resource-level value (with a
+	// trait-level fallback for older data).
+	orgID, ok := rType.GetProfileInt64Value(rType.GetProfile(resource), "orgID")
 	if !ok {
 		return nil, nil, fmt.Errorf("error fetching orgID from team profile")
 	}
@@ -280,12 +280,9 @@ func (o *teamResourceType) Grant(ctx context.Context, principal *v2.Resource, en
 			return nil, err
 		}
 	case resourceTypeTeam.Id:
-		groupTrait, err := rType.GetGroupTrait(entitlement.Resource)
-		if err != nil {
-			return nil, err
-		}
-
-		orgID, ok := rType.GetProfileInt64Value(groupTrait.Profile, "orgID")
+		// profile has moved from GroupTrait to a Resource-level attribute; read
+		// it via GetProfile (resource-level value, with a trait-level fallback).
+		orgID, ok := rType.GetProfileInt64Value(rType.GetProfile(entitlement.Resource), "orgID")
 		if !ok {
 			return nil, fmt.Errorf("error fetching orgID from team profile")
 		}

pkg/connector/user.go

@@ -48,16 +48,22 @@ func userResource(ctx context.Context, user *github.User, userEmail string, extr
 
 	userTrait := []resource.UserTraitOption{
 		resource.WithEmail(userEmail, true),
-		resource.WithUserProfile(profile),
-		resource.WithStatus(v2.UserTrait_Status_STATUS_ENABLED),
+	}
+
+	// profile, status, and icon have moved from UserTrait to Resource-level
+	// attributes. NewUserTrait still defaults the (unset) trait status to
+	// ENABLED, so the enabled semantics are preserved on both levels.
+	resourceOpts := []resource.ResourceOption{
+		resource.WithResourceProfile(profile),
+		resource.WithResourceStatus(v2.Status_RESOURCE_STATUS_ENABLED, ""),
 	}
 
 	for _, email := range extraEmails {
 		userTrait = append(userTrait, resource.WithEmail(email, false))
 	}
 
 	if user.GetAvatarURL() != "" {
-		userTrait = append(userTrait, resource.WithUserIcon(&v2.AssetRef{
+		resourceOpts = append(resourceOpts, resource.WithResourceIcon(&v2.AssetRef{
 			Id: user.GetAvatarURL(),
 		}))
 	}
@@ -70,15 +76,17 @@ func userResource(ctx context.Context, user *github.User, userEmail string, extr
 		}))
 	}
 
+	resourceOpts = append(resourceOpts, resource.WithAnnotation(
+		&v2.ExternalLink{Url: user.GetHTMLURL()},
+		&v2.V1Identifier{Id: strconv.FormatInt(user.GetID(), 10)},
+	))
+
 	ret, err := resource.NewUserResource(
 		displayName,
 		resourceTypeUser,
 		user.GetID(),
 		userTrait,
-		resource.WithAnnotation(
-			&v2.ExternalLink{Url: user.GetHTMLURL()},
-			&v2.V1Identifier{Id: strconv.FormatInt(user.GetID(), 10)},
-		),
+		resourceOpts...,
 	)
 	if err != nil {
 		return nil, err