On the Batch Changes settings page, we show a list of code hosts that support batch changes and whether or not those code hosts currently have credentials configured. This is surfaced over GraphQL via the BatchChangesCodeHost type and its field credential: BatchChangesCredential.

Similarly, we now need a way to surface whether or not a code host has a GH App configured for it for commit signing, and the details of that configuration. Since commit signing configurations will be 1:1 with code host connections, the proposition for this is to add another field to the BatchChangesCodeHost type that mirrors credential. The new schema would be as follows:

type BatchChangesCodeHost {
    """
    Configuration for commit signing, if any has been set up. Always nil if the code
    host type doesn't have commit signing support yet.
    """
    commitSigningConfiguration: CommitSigningConfiguration
    ...
}

"""
Today, the only supported form of commit signing is via a GitHub App.
"""
union CommitSigningConfiguration = GitHubApp

This would enable us to get code host credentials + batches GH Apps in a single request, as opposed to making two queries and matching entities clientside or making individual requests for the GH App for each code host that supports commit signing. The union type, though limited to just one type today, would be easy to expand to diverse commit signing configurations in the future.

To resolve the field, we would switch based on the code host ExternalServiceType. For GitHub, we would try to look up in the DB a GitHub App by the domain "batches" and a BaseURL that matches the code host ExternalServiceID (which is just a normalized URL for the code host). If there is no result, return nil. Otherwise return a gitHubAppResolver for the result. This will require a new gitHubAppsStore method, i.e.

GetByDomain(ctx context.Context, domain types.GitHubAppDomain, baseURL string) (*ghtypes.GitHubApp, error)

Two other notes that would better enable this:

• We should update the gitHubAppsStore.Create() method, when domain is "batches", to check for an existing DB entry with the same base_url, and to fail if one is encountered. This would guarantee that in the "batches" domain, each GH App is for a unique code host.
• We should see about normalizing github_apps.base_url with extsvc.NormalizeBaseURL(), like we do in most other places where we store a code host URL. This would enable us to directly look up the GitHub App by exact string match to the code host ExternalServiceID, which would be faster and more reliable than fuzzy matching.