entitlements-github-plugin 1.2.3 → 1.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39178775eee3074e73cc8fa83b13e6047b67f0b8aa05932f41254a9e74265b60
-  data.tar.gz: 3b73afc1b8e2685adddecc9a9943f96816209d545519c925c0f1080342defa5b
+  metadata.gz: 7866f5cc065f837d70b4a18815f786f9ce5ce0cf24e22330f48db4fadb2bfb8d
+  data.tar.gz: e09e3c17719fb411cc96326370f2a9cbbe4cdaa87fa6a94329deab2081379b1a
 SHA512:
-  metadata.gz: 593b0ccbbb09c47864290d1c9ec1f7ac519e769628159a0cff2357ba48167c2843a9c29e8d52a51f4e5a2d2545eb8f7b9fa6b613e01d149d04d1082e25d9468b
-  data.tar.gz: 698ee25bc5878a969bafbda9e591409c3c7152b4052b1d3de0fc9c1eaa264d8868378a1b20bd88414ec5c9e6923501ce4d550935940031cef31c455a7da2bad1
+  metadata.gz: c690243acde1d9ee347a14ea5fb205bf5e54bbc51dd6cf02c6670aa9fee3f6dd325eb94b069a752e9d0690c06f80b1599d1fd24a227f5f58faaaff381d142a4b
+  data.tar.gz: c91f6a53cc2389628839edf45f8994c81f20919d4a88b5a3ae6f8946142f0708d6e8f8f24120df8f98f01d3011ca51548d3cad46246cfd8e0ea8c7387dda5f6f

data/lib/entitlements/backend/github_org/provider.rb

@@ -104,7 +104,8 @@ module Entitlements
         # Returns an Entitlements::Models::Group object.
         Contract String => Entitlements::Models::Group
         def role_to_group(role)
-          members = github.org_members.keys.select { |username| github.org_members[username] == role }
+          org_members = github.org_members
+          members = org_members.select { |_, member_role| member_role == role }.keys
           Entitlements::Models::Group.new(
             dn: role_dn(role),
             members: Set.new(members),

data/lib/entitlements/service/github.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config/retry"
 
+require "faraday/net_http_persistent"
 require "net/http"
 require "octokit"
 require "uri"
@@ -169,6 +170,9 @@ module Entitlements
       def octokit
         @octokit ||= begin
           client = Octokit::Client.new(access_token: token)
+          middleware = Octokit::Default.middleware.dup
+          middleware.adapter :net_http_persistent
+          client.middleware = middleware
           client.api_endpoint = addr if addr
           client.auto_paginate = true
           client.per_page = 100
@@ -369,9 +373,7 @@ module Entitlements
       # Returns { code: <Integer>, data: <response data structure> }
       Contract String => { code: Integer, data: C::Or[nil, Hash] }
       def graphql_http_post_real(query)
-        uri = URI.parse(File.join(octokit.api_endpoint, "graphql"))
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
+        uri = graphql_uri
 
         request = Net::HTTP::Post.new(uri)
         request.add_field("Authorization", "bearer #{token}")
@@ -379,7 +381,7 @@ module Entitlements
         request.body = JSON.generate("query" => query)
 
         begin
-          response = http.request(request)
+          response = graphql_http.request(request)
 
           if response.code != "200"
             # The retry wrapper retries on 5xx, so log those at WARN to avoid misleading
@@ -411,11 +413,41 @@ module Entitlements
           # Catch-all for any unexpected exception (network blip OR local code bug).
           # We retry below via the synthesized 500, but log at ERROR because this
           # branch can mask programming errors that operators must see.
+          reset_graphql_http
           Entitlements.logger.error "Caught #{e.class} POSTing to #{uri}: #{e.message}"
           { code: 500, data: nil }
         end
       end
 
+      # Return the URI used for GraphQL requests.
+      Contract C::None => URI::Generic
+      def graphql_uri
+        @graphql_uri ||= URI.parse(File.join(octokit.api_endpoint, "graphql"))
+      end
+
+      # Return a started HTTP connection that can be reused across GraphQL requests.
+      Contract C::None => Net::HTTP
+      def graphql_http
+        @graphql_http ||= begin
+          uri = graphql_uri
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == "https"
+          http.start
+          http
+        end
+      end
+
+      # Discard a failed GraphQL connection so the retry wrapper creates a new one.
+      Contract C::None => nil
+      def reset_graphql_http
+        http, @graphql_http = @graphql_http, nil
+        http.finish if http&.started?
+        nil
+      rescue IOError, SystemCallError => e
+        Entitlements.logger.warn "Failed to close GraphQL connection: #{e.message}"
+        nil
+      end
+
       # Create a unique signature for this GitHub instance to identify it in a global cache.
       #
       # Takes no arguments.

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.3"
+    VERSION = "1.2.5"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 1.2.3
+  version: 1.2.5
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-03 00:00:00.000000000 Z
+date: 2026-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: faraday-net_http_persistent
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: faraday-retry
   requirement: !ruby/object:Gem::Requirement