Use a dedicated GH API call to get the e-mail address (#1951)

Depending on the privacy settings, the `/user` endpoint might or might
not contain the primary e-mail even if the user makes an authenticated
call on behalf of themselves. Let's use the `/email` API endpoint
instead.

Fixes: #1950

internal/engine/actions/remediate/pull_request/pull_request.go

@@ -262,6 +262,11 @@ func (r *Remediator) runGit(
 		return fmt.Errorf("cannot get authenticated user: %w", err)
 	}
 
+	email, err := getPrimaryEmail(ctx, r.ghCli)
+	if err != nil {
+		return fmt.Errorf("cannot get primary email: %w", err)
+	}
+
 	logger.Debug().Str("branch", branchBaseName(title)).Msg("Checking out branch")
 	err = wt.Checkout(&git.CheckoutOptions{
 		Branch: plumbing.NewBranchReferenceName(branchBaseName(title)),
@@ -288,7 +293,7 @@ func (r *Remediator) runGit(
 	_, err = wt.Commit(title, &git.CommitOptions{
 		Author: &object.Signature{
 			Name:  u.GetName(),
-			Email: u.GetEmail(),
+			Email: email,
 			When:  time.Now(),
 		},
 	})
@@ -484,3 +489,22 @@ func prFromBranchAlreadyExists(
 
 	return len(openPrs) > 0, nil
 }
+
+func getPrimaryEmail(ctx context.Context, cli provifv1.GitHub) (string, error) {
+	emails, err := cli.ListEmails(ctx, &github.ListOptions{})
+	if err != nil {
+		return "", fmt.Errorf("cannot get email: %w", err)
+	}
+
+	fallback := ""
+	for _, email := range emails {
+		if fallback == "" {
+			fallback = email.GetEmail()
+		}
+		if email.GetPrimary() {
+			return email.GetEmail(), nil
+		}
+	}
+
+	return fallback, nil
+}

internal/engine/actions/remediate/pull_request/pull_request_test.go

@@ -200,6 +200,13 @@ func happyPathMockSetup(mockGitHub *mock_ghclient.MockGitHub) {
 		Email: github.String("[email protected]"),
 		Login: github.String("stacklok-bot"),
 	}, nil)
+	mockGitHub.EXPECT().
+		ListEmails(gomock.Any(), gomock.Any()).Return([]*github.UserEmail{
+		{
+			Email:   github.String("[email protected]"),
+			Primary: github.Bool(true),
+		},
+	}, nil)
 	mockGitHub.EXPECT().
 		GetToken().Return("token")
 	mockGitHub.EXPECT().
@@ -464,6 +471,14 @@ func TestPullRequestRemediate(t *testing.T) {
 					Email: github.String("[email protected]"),
 					Login: github.String("stacklok-bot"),
 				}, nil)
+				// likewise we need to update the branch with a valid e-mail
+				mockGitHub.EXPECT().
+					ListEmails(gomock.Any(), gomock.Any()).Return([]*github.UserEmail{
+					{
+						Email:   github.String("[email protected]"),
+						Primary: github.Bool(true),
+					},
+				}, nil)
 				mockGitHub.EXPECT().
 					GetToken().Return("token")
 				// this is the last call we expect to make. It returns existing PRs from this branch, so we

internal/providers/github/github_rest.go

@@ -614,3 +614,12 @@ func (c *RestClient) CreateComment(ctx context.Context, owner, repo string, numb
 	})
 	return err
 }
+
+// ListEmails lists all emails for the authenticated user.
+func (c *RestClient) ListEmails(ctx context.Context, opts *github.ListOptions) ([]*github.UserEmail, error) {
+	emails, _, err := c.client.Users.ListEmails(ctx, opts)
+	if err != nil {
+		return nil, err
+	}
+	return emails, nil
+}

pkg/providers/v1/providers.go

@@ -107,6 +107,7 @@ type GitHub interface {
 	CreatePullRequest(ctx context.Context, owner, repo, title, body, head, base string) (*github.PullRequest, error)
 	ListPullRequests(ctx context.Context, owner, repo string, opt *github.PullRequestListOptions) ([]*github.PullRequest, error)
 	CreateComment(ctx context.Context, owner, repo string, number int, comment string) error
+	ListEmails(ctx context.Context, opts *github.ListOptions) ([]*github.UserEmail, error)
 }
 
 // ParseAndValidate parses the given provider configuration and validates it.