perf(github): Cache accessible repo IDs for accessibleOnly search

When accessibleOnly=true with a search query, the old path fetched all
installation repos (up to 5,000) on every debounced keystroke, then
filtered with a Python list comprehension. Replace this with a cached
set of accessible repo IDs (5-min Redis TTL) combined with the GitHub
Search API, reducing each typed query from O(pages) API calls to a
single search call plus a Redis lookup.

Refs VDY-68

Author: jaydgoss

src/sentry/integrations/github/client.py

@@ -8,6 +8,7 @@
 
 import orjson
 import sentry_sdk
+from django.core.cache import cache
 from requests import PreparedRequest
 
 from sentry.constants import ObjectStatus
@@ -549,6 +550,22 @@ def get_repos(self, page_number_limit: int | None = None) -> list[dict[str, Any]
                 page_number_limit=page_number_limit,
             )
 
+    def get_accessible_repo_ids(self, ttl: int = 300) -> set[int]:
+        """
+        Return the set of GitHub repo IDs accessible to this installation.
+        Cached in Django cache (Redis) for ``ttl`` seconds to avoid
+        re-fetching all pages on every keystroke.
+        """
+        cache_key = f"github:accessible_repo_ids:{self.integration.id}"
+        cached = cache.get(cache_key)
+        if cached is not None:
+            return set(cached)
+
+        all_repos = self.get_repos()
+        repo_ids = {r["id"] for r in all_repos if not r.get("archived")}
+        cache.set(cache_key, list(repo_ids), ttl)
+        return repo_ids
+
     def search_repositories(self, query: bytes) -> Mapping[str, Sequence[Any]]:
         """
         Find repositories matching a query.

src/sentry/integrations/github/integration.py

@@ -336,9 +336,12 @@ def get_repositories(
         This fetches all repositories accessible to the Github App
         https://docs.github.com/en/rest/apps/installations#list-repositories-accessible-to-the-app-installation
         """
-        if not query or accessible_only:
-            all_repos = self.get_client().get_repos(page_number_limit=page_number_limit)
-            repos: list[RepositoryInfo] = [
+        client = self.get_client()
+
+        # No query: fetch all accessible repos (existing behavior)
+        if not query:
+            all_repos = client.get_repos(page_number_limit=page_number_limit)
+            return [
                 {
                     "name": i["name"],
                     "identifier": i["full_name"],
@@ -348,14 +351,27 @@ def get_repositories(
                 for i in all_repos
                 if not i.get("archived")
             ]
-            if query:
-                query_lower = query.lower()
-                repos = [r for r in repos if query_lower in str(r["identifier"]).lower()]
-            return repos
 
+        # Query + accessible_only: use Search API + cached ID set
+        if accessible_only:
+            accessible_ids = client.get_accessible_repo_ids()
+            full_query = build_repository_query(self.model.metadata, self.model.name, query)
+            response = client.search_repositories(full_query)
+            return [
+                {
+                    "name": i["name"],
+                    "identifier": i["full_name"],
+                    "external_id": self.get_repo_external_id(i),
+                    "default_branch": i.get("default_branch"),
+                }
+                for i in response.get("items", [])
+                if i["id"] in accessible_ids
+            ]
+
+        # Query without accessible_only: existing search behavior
         full_query = build_repository_query(self.model.metadata, self.model.name, query)
-        response = self.get_client().search_repositories(full_query)
-        search_repos: list[RepositoryInfo] = [
+        response = client.search_repositories(full_query)
+        return [
             {
                 "name": i["name"],
                 "identifier": i["full_name"],
@@ -364,7 +380,6 @@ def get_repositories(
             }
             for i in response.get("items", [])
         ]
-        return search_repos
 
     def get_unmigratable_repositories(self) -> list[RpcRepository]:
         accessible_repos = self.get_repositories()

tests/sentry/integrations/github/test_integration.py

@@ -679,16 +679,40 @@ def test_get_repositories_search_param(self) -> None:
 
     @responses.activate
     def test_get_repositories_accessible_only(self) -> None:
-        """When accessible_only=True, fetches installation repos and filters locally."""
+        """accessible_only+query uses Search API filtered by cached accessible IDs."""
         with self.tasks():
             self.assert_setup_flow()
 
+        querystring = urlencode({"q": "fork:true org:Test Organization foo"})
+        responses.add(
+            responses.GET,
+            f"{self.base_url}/search/repositories?{querystring}",
+            json={
+                "items": [
+                    {
+                        "id": 1296269,
+                        "name": "foo",
+                        "full_name": "Test-Organization/foo",
+                        "default_branch": "master",
+                    },
+                    {
+                        "id": 9999999,
+                        "name": "foo-external",
+                        "full_name": "Other-Org/foo-external",
+                        "default_branch": "main",
+                    },
+                ]
+            },
+        )
+
         integration = Integration.objects.get(provider=self.provider.key)
         installation = get_installation_of_type(
             GitHubIntegration, integration, self.organization.id
         )
 
         result = installation.get_repositories("foo", accessible_only=True)
+        # foo-external is filtered out: its id (9999999) is the archived repo's id,
+        # which is excluded from the accessible set
         assert result == [
             {
                 "name": "foo",
@@ -700,10 +724,17 @@ def test_get_repositories_accessible_only(self) -> None:
 
     @responses.activate
     def test_get_repositories_accessible_only_no_match(self) -> None:
-        """When accessible_only=True and nothing matches, returns empty list."""
+        """When accessible_only=True and search returns no accessible repos, returns empty list."""
         with self.tasks():
             self.assert_setup_flow()
 
+        querystring = urlencode({"q": "fork:true org:Test Organization nonexistent"})
+        responses.add(
+            responses.GET,
+            f"{self.base_url}/search/repositories?{querystring}",
+            json={"items": []},
+        )
+
         integration = Integration.objects.get(provider=self.provider.key)
         installation = get_installation_of_type(
             GitHubIntegration, integration, self.organization.id
@@ -712,6 +743,49 @@ def test_get_repositories_accessible_only_no_match(self) -> None:
         result = installation.get_repositories("nonexistent", accessible_only=True)
         assert result == []
 
+    @responses.activate
+    def test_get_repositories_accessible_only_caches_ids(self) -> None:
+        """Second accessible_only call uses cached IDs instead of re-fetching all repos."""
+        with self.tasks():
+            self.assert_setup_flow()
+
+        querystring = urlencode({"q": "fork:true org:Test Organization foo"})
+        responses.add(
+            responses.GET,
+            f"{self.base_url}/search/repositories?{querystring}",
+            json={
+                "items": [
+                    {
+                        "id": 1296269,
+                        "name": "foo",
+                        "full_name": "Test-Organization/foo",
+                        "default_branch": "master",
+                    },
+                ]
+            },
+        )
+
+        integration = Integration.objects.get(provider=self.provider.key)
+        installation = get_installation_of_type(
+            GitHubIntegration, integration, self.organization.id
+        )
+
+        # First call: cache miss, fetches /installation/repositories + search
+        result1 = installation.get_repositories("foo", accessible_only=True)
+        install_repo_calls = [
+            c for c in responses.calls if "/installation/repositories" in c.request.url
+        ]
+        first_fetch_count = len(install_repo_calls)
+        assert first_fetch_count > 0
+
+        # Second call: cache hit, only search is called (no new /installation/repositories)
+        result2 = installation.get_repositories("foo", accessible_only=True)
+        install_repo_calls = [
+            c for c in responses.calls if "/installation/repositories" in c.request.url
+        ]
+        assert len(install_repo_calls) == first_fetch_count
+        assert result1 == result2
+
     @responses.activate
     def test_get_repositories_all_and_pagination(self) -> None:
         """Fetch all repositories and test the pagination logic."""