feat(integrations): setup-spec batch 9 — AWS, GitHub, Kubernetes, Twilio (#4168)

[muddlebee]

Fixes #4168

Describe the changes you have made in this PR -

Final setup-spec batch: migrate the last four remaining integrations setup handlers onto the shared apply_setup flow so CLI and wizard write store + keyring + .env the same way.

• aws — SetupMode for IAM role vs access keys; region always-on; verifier wrapper nests static keys for AWSIntegrationConfig
• kubernetes — SetupMode for kubeconfig file path vs inline YAML; either/or still enforced by the probe verifier
• twilio — flat SMS fields for env mirroring; shape_twilio_credentials used by classify/setup verifier for the nested sms model
• github — GITHUB_SETUP spec; CLI/wizard keep browser OAuth + rich repo-scope validation, then persist through apply_setup (token → keyring)
• Constants modules for AWS / GitHub / Kubernetes; Twilio SMS env names; catalog reads those constants
• Env round-trip coverage for aws/github/kubernetes + a dedicated Twilio nested-sms assertion

After this PR: 45 of 45 setup handlers are on the shared flow.

Demo/Screenshot for feature changes and bug fixes -

$ uv run pytest tests/integrations/test_setup_spec_env_round_trip.py \
    tests/cli/test_integrations_setup_github.py tests/integrations/test_twilio.py -q
63 passed

$ uv run python -c "from pathlib import Path; import integrations.cli as c; \
    print(len(c._HANDLERS), len(list(Path('integrations').glob('*/setup.py'))))"
44 44

---

Code Understanding and AI Usage

Did you use AI assistance (ChatGPT, Claude, Copilot, etc.) to write any part of this code?

• No, I wrote all the code myself
• Yes, I used AI assistance (continue below)

If you used AI assistance:

• I have reviewed every single line of the AI-generated code
• I can explain the purpose and logic of each function/component I added
• I have tested edge cases and understand how the code handles them
• I have modified the AI output to follow this project's coding standards and conventions

Explain your implementation approach:
Issue #4168 was about store-only CLI setup vs three-tier wizard writes. Batches 1–8 migrated 40 integrations; these four were left because they needed mode pickers, nested credential reshaping, or custom pre-collection (GitHub browser OAuth).

Approaches considered:

1. Extend apply_setup with nested-credential support — rejected; Better Stack already keeps list-ish values as strings and normalizes on read.
2. Wait for more framework hooks — unnecessary; SetupMode + verifier reshape + optional finalize already cover these cases.
3. Force GitHub through _run_spec_setup — would drop browser OAuth and the rich repo-scope report.

Chosen approach: declare specs like prior batches; keep GitHub’s interactive collection custom and hand values to apply_setup after the existing validation report. Twilio/AWS flatten for env vars and reshape only at verify/classify boundaries so store and catalog stay compatible.

Key pieces: integrations/{aws,github,kubernetes,twilio}/setup.py, shape_* helpers, wizard configure_from_spec for AWS, GitHub wizard persist path.

---

Checklist before requesting a review

• I have added proper PR title and linked to the issue
• I have performed a self-review of my code
• I can explain the purpose of every function, class, and logic block I added
• I understand why my changes work and have tested them thoroughly
• I have considered potential edge cases and how my code handles them
• If it is a core feature, I have added thorough tests
• My code follows the project's style guidelines and conventions

Note: Please check Allow edits from maintainers if you would like us to assist in the PR.

[github-actions]

Greptile code review

This repo uses Greptile for automated review. Before merge, aim for Confidence Score: 5/5 with zero unresolved review threads — see CONTRIBUTING.md.

Run a review — add a PR comment with:

@greptile review

Give it ~5-10 minutes (sometimes longer) for results, then fix feedback and re-trigger until you reach Confidence Score: 5/5.

Optional: automate with the greploop skill.

[greptile-apps]

Greptile Summary

Migrates the remaining AWS, GitHub, Kubernetes, and Twilio setup handlers to the shared setup flow.

• Adds declarative setup specifications, credential-shaping helpers, and centralized environment-variable constants.
• Routes inline Kubernetes kubeconfig content through keyring-backed secret persistence while retaining path-only configuration in .env.
• Preserves GitHub browser OAuth and repository-scope validation before shared persistence.
• Adds environment round-trip and setup-flow coverage for the migrated integrations.

Confidence Score: 5/5

The PR appears safe to merge with no blocking failures remaining in the Kubernetes secret-storage fix.

The inline kubeconfig is routed to keyring storage, removed from plaintext .env content during synchronization, and resolved through the shared credential loader.

Important Files Changed

Filename	Overview
config/env_file.py	Classifies inline kubeconfig content as sensitive so shared persistence routes it to the keyring and removes plaintext assignments during .env synchronization.
integrations/kubernetes/setup.py	Declares path and inline kubeconfig setup modes, masking inline YAML and mapping it to the newly protected environment key.
integrations/cli.py	Replaces bespoke AWS, Kubernetes, and Twilio setup persistence and GitHub store writes with the shared setup flow.
integrations/github/setup.py	Defines GitHub MCP fields, secret-token persistence, verification, and authenticated-user analytics finalization.
integrations/aws/setup.py	Defines role and static-key authentication modes and reshapes flat setup fields for AWS verification.
integrations/twilio/setup.py	Defines flat environment-backed Twilio SMS fields and reshapes them into the nested runtime model.

_{Reviews (2): Last reviewed commit: "fix(integrations): keyring-route inline ..." | Re-trigger Greptile}

[muddlebee]

@greptile review

[github-actions]

🎉 MERGED! @muddlebee just shipped something. The diff gods are pleased. 🙌

---

👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome.