Wire syncAppInstallations into syncSelectedRepos for delta processing

- Call enrichContextWithEnterprise in syncSelectedSettings (index.js)
- Call syncAppInstallations with changedSubOrgs/changedRepos in syncSelectedRepos
- Add _buildAppChangesFromDelta helper to extract affected apps from changed
  suborg/repo configs and compute repository_selection per app
- syncAppInstallations now handles three modes: pre-computed delta, config-based
  delta (from changed files), and full sync

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: decyjphr

index.js

@@ -92,6 +92,9 @@ module.exports = (robot, { getRouter }, Settings = require('./lib/settings')) =>
       const config = Object.assign({}, deploymentConfig, runtimeConfig)
       robot.log.debug(`config for ref ${ref} is ${JSON.stringify(config)}`)
 
+      // Enrich context with enterprise info for app installation management
+      await enrichContextWithEnterprise(context)
+
       // Load base branch config for NOP filtering (only show PR-introduced changes)
       let baseConfig = null
       if (nop && baseRef) {

lib/settings.js

@@ -655,6 +655,15 @@ class Settings {
         await settings.loadConfigs()
         await settings.updateAll()
       }
+
+      // Sync app installations for affected apps (delta mode)
+      await settings.syncAppInstallations({
+        appGithub: context.appGithub,
+        enterpriseSlug: context.enterpriseSlug,
+        changedSubOrgs: subOrgs,
+        changedRepos: repos
+      })
+
       await settings.handleResults()
     } catch (error) {
       settings.logError(error.message)
@@ -1423,10 +1432,14 @@ class Settings {
    * @param {Array}  [options.appChanges] - Pre-computed per-app changes (delta mode)
    */
   async syncAppInstallations (options = {}) {
-    const { appGithub, enterpriseSlug, appChanges } = options
+    const { appGithub, enterpriseSlug, appChanges, changedSubOrgs, changedRepos } = options
 
     const appInstallationsConfig = this.config.app_installations
-    if (!appInstallationsConfig || !Array.isArray(appInstallationsConfig) || appInstallationsConfig.length === 0) {
+    // Check if any layer has app_installations config (org, suborg, or repo)
+    const hasOrgConfig = appInstallationsConfig && Array.isArray(appInstallationsConfig) && appInstallationsConfig.length > 0
+    const hasChangedConfigs = (changedSubOrgs && changedSubOrgs.length > 0) || (changedRepos && changedRepos.length > 0)
+
+    if (!hasOrgConfig && !hasChangedConfigs && (!appChanges || appChanges.length === 0)) {
       this.log.debug('No app_installations config found, skipping')
       return
     }
@@ -1462,8 +1475,16 @@ class Settings {
 
     let results
     if (appChanges && appChanges.length > 0) {
-      // Delta mode: process pre-computed changes
+      // Pre-computed delta mode
       results = await plugin.syncDelta(appChanges)
+    } else if (hasChangedConfigs) {
+      // Delta mode: build app changes from changed suborg/repo configs
+      const deltaChanges = await this._buildAppChangesFromDelta(appGithub, enterpriseSlug, changedSubOrgs, changedRepos)
+      if (deltaChanges.length > 0) {
+        results = await plugin.syncDelta(deltaChanges)
+      } else {
+        results = []
+      }
     } else {
       // Full sync mode: compute desired state from all config layers
       const desiredState = await this._computeFullAppDesiredState(appInstallationsConfig, appGithub, enterpriseSlug)
@@ -1476,6 +1497,98 @@ class Settings {
     this.appendToResults(results)
   }
 
+  /**
+   * Build delta-based app changes from changed suborg/repo config files.
+   * Extracts app_installations from each changed config and computes
+   * repository_selection / repository_unselection per app.
+   * @private
+   */
+  async _buildAppChangesFromDelta (appGithub, enterpriseSlug, changedSubOrgs = [], changedRepos = []) {
+    const AppOctokitClient = require('./appOctokitClient')
+    const repoSelector = new RepoSelector(this.github, this.repo.owner, this.log)
+    const appChangeMap = new Map() // app_slug → { installation_id, repository_selection, repository_unselection }
+
+    // Get installation map (app_slug → installation_id)
+    let installationMap = new Map()
+    if (appGithub && enterpriseSlug) {
+      try {
+        const enterpriseClient = new AppOctokitClient({ github: appGithub, enterpriseSlug, log: this.log })
+        const orgInstallations = await enterpriseClient.listOrgInstallations(this.repo.owner)
+        for (const inst of orgInstallations) {
+          installationMap.set(inst.app_slug, inst.id)
+        }
+      } catch (e) {
+        this.log.error(`Failed to list org installations for delta: ${e.message}`)
+        return []
+      }
+    }
+
+    // Process changed suborg configs
+    for (const suborg of changedSubOrgs) {
+      const suborgConfig = this.subOrgConfigs && this.subOrgConfigs[suborg.repo]
+      if (!suborgConfig || !suborgConfig.app_installations) continue
+
+      // Resolve repos for this suborg's current targeting
+      const criteria = {}
+      if (suborgConfig.suborgrepos) criteria.names = suborgConfig.suborgrepos
+      if (suborgConfig.suborgteams) criteria.teams = suborgConfig.suborgteams
+      if (suborgConfig.suborgproperties) criteria.custom_properties = suborgConfig.suborgproperties
+
+      let suborgRepos = new Set()
+      try {
+        suborgRepos = await repoSelector.resolve(criteria)
+      } catch (e) {
+        this.log.debug(`Error resolving suborg repos for '${suborg.repo}': ${e.message}`)
+      }
+
+      for (const appConfig of suborgConfig.app_installations) {
+        const slug = appConfig.app_slug
+        if (!slug) continue
+        const installationId = installationMap.get(slug)
+        if (!installationId) continue
+
+        if (!appChangeMap.has(slug)) {
+          appChangeMap.set(slug, {
+            app_slug: slug,
+            installation_id: installationId,
+            repository_selection: new Set(),
+            repository_unselection: new Set()
+          })
+        }
+        const change = appChangeMap.get(slug)
+        for (const repo of suborgRepos) {
+          change.repository_selection.add(repo)
+        }
+      }
+    }
+
+    // Process changed repo configs
+    for (const repo of changedRepos) {
+      const repoConfig = this.repoConfigs &&
+        (this.repoConfigs[`${repo.repo}.yml`] || this.repoConfigs[`${repo.repo}.yaml`])
+      if (!repoConfig || !repoConfig.app_installations) continue
+
+      for (const appConfig of repoConfig.app_installations) {
+        const slug = appConfig.app_slug
+        if (!slug) continue
+        const installationId = installationMap.get(slug)
+        if (!installationId) continue
+
+        if (!appChangeMap.has(slug)) {
+          appChangeMap.set(slug, {
+            app_slug: slug,
+            installation_id: installationId,
+            repository_selection: new Set(),
+            repository_unselection: new Set()
+          })
+        }
+        appChangeMap.get(slug).repository_selection.add(repo.repo)
+      }
+    }
+
+    return [...appChangeMap.values()]
+  }
+
   /**
    * Compute the full desired state for all managed apps by merging
    * org + suborg + repo level app_installations configs.