[SergK]

Summary

 listRepositories(owner)
   GET /orgs/{owner}         → organization: GET /orgs/{owner}/repos (unchanged)
   404                       → user owner
-    GET /users/{owner}/repos                  # public only, also for the token user
+    GET /user                                 # token login
+      401 / 403             → login unknown
+      other error           → fail: "failed to get current user"
+    owner == login (case-insensitive)
+      GET /user/repos?affiliation=owner       # private included
+    else
+      GET /users/{owner}/repos

The organization picker offers the token user's own login as an owner. For that owner, private repositories were missing from the Repository picker and from the create-mode "already exists" check, so a name clash surfaced later in codebase-operator.

• affiliation=owner: the default affiliation adds collaborator and organization member repositories, which belong to other owners.
• 401 / 403 on GET /user (GitHub App installation token) keeps the public listing; a rejected token still fails on GET /users/{owner}/repos.

Evidence

Live GitHub, classic PAT with repo scope, owner = token login (first page, 100 repositories):

Endpoint	Private repositories
GET /users/{login}/repos (before)	0
GET /user/repos?affiliation=owner (after)	12

Tests (ListRepositories against httptest, requests recorded):

• Before: TestGitHubProviderListRepositoriesForUser rows token user and token user in another letter case fail: the provider requests /users/jdoe/repos.
  After: /user, /user/repos?affiliation=owner&per_page=100, page 2; the private repository is returned.
• Rows other user and 401 / 403 on GET /user: /user, then /users/octocat/repos; result unchanged.
• TestGitHubProviderListRepositoriesErrors: 404 / 500 on GET /user fail with failed to get current user; failures on /users/{owner}/repos and /user/repos keep their classification (404, 502, 500).

Not testbed-verified: the testbed runs GitLab only.

Merge Danger

Door: two-way

Blast Radius: GitHub user owners

• One extra GET /user per user-owner listing, on cache miss only.
• A GET /user failure other than 401 / 403 now fails another user's listing instead of returning its public repositories.
• The token user's private repository names become listable through the API, which has no caller authentication.

[epmd-edp]

Pipeline review-gitfusion-main-wpx9p — ✓ Passed

Status	Task	Duration
✓ Passed	github-set-pending-status	7s
✓ Passed	fetch-repository	17s
✓ Passed	init-values	6s
✓ Passed	get-cache	59s
✓ Passed	commit-validate	6s
✓ Passed	dockerfile-lint	6s
✓ Passed	helm-lint	7s
✓ Passed	helm-docs	7s
✓ Passed	build	1m4s
✓ Passed	sonar	26s
✓ Passed	buildkit-verify	16s
✓ Passed	save-cache	1m9s
✓ Passed	github-report-pipeline-status	6s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.