[MergeShip] MVP-1: GitHub OAuth onboarding + contributor profile bootstrap

[Shivampal157]

Context

This is an implementation sub-issue related to C4GT DMP 2026 ticket:

• Parent: [DMP 2026]: MergeShip - Gamified Open Source Orchestration & Mentorship Platform #774

I am taking up MVP-1 so progress can be delivered in small reviewable PRs.

Scope (MVP-1)

• GitHub OAuth login flow
• Contributor profile creation on first login
• Basic profile fields persistence (github_id, username, avatar, joined_at, default_level=L1)
• Protected endpoint to fetch current user profile
• .env.example + setup notes for OAuth variables

Out of Scope (for this issue)

• L1/L2/L3 scoring logic
• Maintainer triage queue
• XP/gamification engine

Deliverables

• Backend OAuth + profile APIs
• Minimal frontend login + profile page wiring
• Setup documentation update
• Basic tests for auth/profile endpoints

Acceptance Criteria

• User can sign in with GitHub successfully
• First login creates contributor profile
• Subsequent login returns existing profile
• Protected profile endpoint works with auth
• Local setup works from docs without manual guesswork

PR Plan

I will open one PR for this issue:

• feat(auth): github oauth onboarding and contributor profile bootstrap

[Shivampal157]

hii @Ayush-Patel-56, I would like to work on this sub-issue as MVP-1 under #774.
If this scope looks good to mentors/maintainers, I will raise the PR

[Shivampal157]

Adding implementation notes for clarity:

• Proposed auth approach: GitHub OAuth callback -> app-issued session/JWT -> protected /me profile endpoint.
• Minimum OAuth scopes: read:user (and user:email only if required).
• Security checks: OAuth state validation, token handling via env vars, and no sensitive token logging.

[Ayush-Patel-56]

Hi @Shivampal157, apologies for delayed reply. Your plan sounds good, It seems like you focused mainly on authentication and profile creation, which is good as the first step. We'll look into your PR soon. Thanks!