fix(connector): classify GraphQL responses on the App-token path

newGitHubAppClients shared one unwrapped HTTP client for REST and GraphQL,
so the GraphQL client lost the statusClassifyingTransport that
newGitHubGraphqlClient applies. Without it, shurcooL/githubv4 surfaces
429/5xx as opaque strings that reach the SDK as codes.Unknown and abort the
sync instead of being retried.

Wrap the GraphQL client's transport with statusClassifyingTransport, layered
above tokenRefreshTransport so a 401 is still observed and retried before any
surviving non-2xx is converted to a classified error. REST is unchanged
(go-github classifies via wrapGitHubError).

Author: johnallers

pkg/connector/token_refresh.go

@@ -132,6 +132,15 @@ func newGitHubAppHTTPClient(ctx context.Context, rts *refreshableTokenSource) (*
 // newGitHubAppClients constructs the REST and GraphQL clients used by the
 // GitHub App install-token path, sharing the layered httpClient so the
 // 401-refresh middleware applies to both surfaces.
+//
+// The GraphQL client gets an extra statusClassifyingTransport layered on top of
+// the shared transport: shurcooL/githubv4 surfaces non-2xx responses as opaque
+// strings, so without it transient errors (429, 5xx) would reach the SDK as
+// codes.Unknown and abort the sync instead of being retried. It must sit above
+// the 401-retry layer so tokenRefreshTransport still observes a raw 401 and can
+// retry it; only a non-2xx that survives the retry is converted to a classified
+// error. The REST client doesn't need this — go-github exposes structured
+// errors that wrapGitHubError classifies at the call site.
 func newGitHubAppClients(instanceURL string, httpClient *http.Client) (*github.Client, *githubv4.Client, error) {
 	instanceURL = strings.TrimSuffix(instanceURL, "/")
 
@@ -144,16 +153,21 @@ func newGitHubAppClients(instanceURL string, httpClient *http.Client) (*github.C
 		}
 	}
 
+	gqlHTTPClient := &http.Client{
+		Timeout:   httpClient.Timeout,
+		Transport: &statusClassifyingTransport{base: httpClient.Transport},
+	}
+
 	var gqlClient *githubv4.Client
 	if instanceURL != "" && instanceURL != githubDotCom {
 		gqlURL, err := url.Parse(instanceURL)
 		if err != nil {
 			return nil, nil, err
 		}
 		gqlURL.Path = "/api/graphql"
-		gqlClient = githubv4.NewEnterpriseClient(gqlURL.String(), httpClient)
+		gqlClient = githubv4.NewEnterpriseClient(gqlURL.String(), gqlHTTPClient)
 	} else {
-		gqlClient = githubv4.NewClient(httpClient)
+		gqlClient = githubv4.NewClient(gqlHTTPClient)
 	}
 	return gc, gqlClient, nil
 }