entitlements-github-plugin 1.2.3 → 1.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39178775eee3074e73cc8fa83b13e6047b67f0b8aa05932f41254a9e74265b60
-  data.tar.gz: 3b73afc1b8e2685adddecc9a9943f96816209d545519c925c0f1080342defa5b
+  metadata.gz: 071c51c88ea969a0054354c03b389caa59e505d54a2fb75bcbdc9e85a6422101
+  data.tar.gz: 207da4d9282f67aab20d0cdc2d70b7c167744b193f78010c6404f8de53923801
 SHA512:
-  metadata.gz: 593b0ccbbb09c47864290d1c9ec1f7ac519e769628159a0cff2357ba48167c2843a9c29e8d52a51f4e5a2d2545eb8f7b9fa6b613e01d149d04d1082e25d9468b
-  data.tar.gz: 698ee25bc5878a969bafbda9e591409c3c7152b4052b1d3de0fc9c1eaa264d8868378a1b20bd88414ec5c9e6923501ce4d550935940031cef31c455a7da2bad1
+  metadata.gz: 06d52ba0138200f3fde882c0b346850cd9d01c216aba74b565a87b960c8aa72aea1ac081de1e7414e2f2e38bdc025856449a276a5fcc3fd76a1f0013630273a9
+  data.tar.gz: 7aa06883ee15010437d009b96ac5831e5ca9cb1585e96b6f11ec626d3e43761343b0d21bb1907260a3faf3e76f0e2f18e716dc2db231e2182b59efa8f028b57a

data/lib/entitlements/service/github.rb

@@ -369,9 +369,7 @@ module Entitlements
       # Returns { code: <Integer>, data: <response data structure> }
       Contract String => { code: Integer, data: C::Or[nil, Hash] }
       def graphql_http_post_real(query)
-        uri = URI.parse(File.join(octokit.api_endpoint, "graphql"))
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
+        uri = graphql_uri
 
         request = Net::HTTP::Post.new(uri)
         request.add_field("Authorization", "bearer #{token}")
@@ -379,7 +377,7 @@ module Entitlements
         request.body = JSON.generate("query" => query)
 
         begin
-          response = http.request(request)
+          response = graphql_http.request(request)
 
           if response.code != "200"
             # The retry wrapper retries on 5xx, so log those at WARN to avoid misleading
@@ -411,11 +409,41 @@ module Entitlements
           # Catch-all for any unexpected exception (network blip OR local code bug).
           # We retry below via the synthesized 500, but log at ERROR because this
           # branch can mask programming errors that operators must see.
+          reset_graphql_http
           Entitlements.logger.error "Caught #{e.class} POSTing to #{uri}: #{e.message}"
           { code: 500, data: nil }
         end
       end
 
+      # Return the URI used for GraphQL requests.
+      Contract C::None => URI::Generic
+      def graphql_uri
+        @graphql_uri ||= URI.parse(File.join(octokit.api_endpoint, "graphql"))
+      end
+
+      # Return a started HTTP connection that can be reused across GraphQL requests.
+      Contract C::None => Net::HTTP
+      def graphql_http
+        @graphql_http ||= begin
+          uri = graphql_uri
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == "https"
+          http.start
+          http
+        end
+      end
+
+      # Discard a failed GraphQL connection so the retry wrapper creates a new one.
+      Contract C::None => nil
+      def reset_graphql_http
+        http, @graphql_http = @graphql_http, nil
+        http.finish if http&.started?
+        nil
+      rescue IOError, SystemCallError => e
+        Entitlements.logger.warn "Failed to close GraphQL connection: #{e.message}"
+        nil
+      end
+
       # Create a unique signature for this GitHub instance to identify it in a global cache.
       #
       # Takes no arguments.

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.3"
+    VERSION = "1.2.4"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 1.2.3
+  version: 1.2.4
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-03 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts