entitlements-github-plugin 1.2.4 → 1.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 071c51c88ea969a0054354c03b389caa59e505d54a2fb75bcbdc9e85a6422101
-  data.tar.gz: 207da4d9282f67aab20d0cdc2d70b7c167744b193f78010c6404f8de53923801
+  metadata.gz: e8b4641323dd4da38ecb87c7f94eacecdfc20508dfdeb0e1b02030c31fe67ab7
+  data.tar.gz: c9180370314b8e80b776ecc554fba1310cc690a246ddc1ac99509263dbb01547
 SHA512:
-  metadata.gz: 06d52ba0138200f3fde882c0b346850cd9d01c216aba74b565a87b960c8aa72aea1ac081de1e7414e2f2e38bdc025856449a276a5fcc3fd76a1f0013630273a9
-  data.tar.gz: 7aa06883ee15010437d009b96ac5831e5ca9cb1585e96b6f11ec626d3e43761343b0d21bb1907260a3faf3e76f0e2f18e716dc2db231e2182b59efa8f028b57a
+  metadata.gz: a0311bcc81ebeac4a1ea1852962bf5a7b592771e2ed11ab1955e199bf5d935d5117e7632167d6bcda55d6b979167faa1cba79744282e55957e011975816b8417
+  data.tar.gz: 6de304801162205be96002493fedff35431cc37823fdc0b6f80933731fd89ae7ce15cf820be1a8e82dbb77a607e50a0900cba9604872566fac8b829d01c58fc2

data/lib/entitlements/backend/github_org/provider.rb

@@ -104,7 +104,8 @@ module Entitlements
         # Returns an Entitlements::Models::Group object.
         Contract String => Entitlements::Models::Group
         def role_to_group(role)
-          members = github.org_members.keys.select { |username| github.org_members[username] == role }
+          org_members = github.org_members
+          members = org_members.select { |_, member_role| member_role == role }.keys
           Entitlements::Models::Group.new(
             dn: role_dn(role),
             members: Set.new(members),

data/lib/entitlements/service/github.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config/retry"
 
+require "faraday/net_http_persistent"
 require "net/http"
 require "octokit"
 require "uri"
@@ -169,6 +170,9 @@ module Entitlements
       def octokit
         @octokit ||= begin
           client = Octokit::Client.new(access_token: token)
+          middleware = Octokit::Default.middleware.dup
+          middleware.adapter :net_http_persistent
+          client.middleware = middleware
           client.api_endpoint = addr if addr
           client.auto_paginate = true
           client.per_page = 100
@@ -388,23 +392,29 @@ module Entitlements
             return { code: response.code.to_i, data: { "body" => response.body } }
           end
 
-          begin
-            data = JSON.parse(response.body)
-            if data.key?("errors")
-              # Synthesized 500 below triggers a retry, so log at WARN. Note: some GraphQL
-              # `errors` are permanent (bad query, auth, schema). The retry wrapper's final
-              # "Giving up" ERROR will surface persistent cases.
-              Entitlements.logger.warn "Errors reported: #{data['errors'].inspect}"
-              return { code: 500, data: }
-            end
-            { code: response.code.to_i, data: }
-          rescue JSON::ParserError => e
-            # JSON parse errors mean the API returned something we can't interpret. The
-            # synthesized 500 below triggers a retry, but the cause is more likely a real
-            # protocol/server problem than a transient network blip, so log at ERROR.
-            Entitlements.logger.error "#{e.class} #{e.message}: #{response.body.inspect}"
-            { code: 500, data: { "body" => response.body } }
+          data = JSON.parse(response.body)
+          if data.key?("errors")
+            # Synthesized 500 below triggers a retry, so log at WARN. Note: some GraphQL
+            # `errors` are permanent (bad query, auth, schema). The retry wrapper's final
+            # "Giving up" ERROR will surface persistent cases.
+            Entitlements.logger.warn "Errors reported: #{data['errors'].inspect}"
+            return { code: 500, data: }
           end
+
+          { code: response.code.to_i, data: }
+
+        rescue Net::ReadTimeout => e
+          # Defend against network blips, those can be safely retried via the
+          # synthesized 500 below, so log at WARN.
+          reset_graphql_http
+          Entitlements.logger.warn "#{e.class} #{e.message}"
+          { code: 500, data: nil }
+        rescue JSON::ParserError => e
+          # JSON parse errors mean the API returned something we can't interpret. The
+          # synthesized 500 below triggers a retry, but the cause is more likely a real
+          # protocol/server problem than a transient network blip, so log at ERROR.
+          Entitlements.logger.error "#{e.class} #{e.message}: #{response.body.inspect}"
+          { code: 500, data: { "body" => response.body } }
         rescue => e
           # Catch-all for any unexpected exception (network blip OR local code bug).
           # We retry below via the synthesized 500, but log at ERROR because this

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.4"
+    VERSION = "1.2.6"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 1.2.4
+  version: 1.2.6
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-09 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: faraday-net_http_persistent
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: faraday-retry
   requirement: !ruby/object:Gem::Requirement