entitlements-github-plugin 1.2.6 → 1.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8b4641323dd4da38ecb87c7f94eacecdfc20508dfdeb0e1b02030c31fe67ab7
-  data.tar.gz: c9180370314b8e80b776ecc554fba1310cc690a246ddc1ac99509263dbb01547
+  metadata.gz: 41951a6ab48f3605dd85973777867619620b508e2a7ac1f1ec78451dbcf42170
+  data.tar.gz: 400ab0cb03e6b8dfda7945a07eb51a1d5665615ea0bb535598a35b920c857dca
 SHA512:
-  metadata.gz: a0311bcc81ebeac4a1ea1852962bf5a7b592771e2ed11ab1955e199bf5d935d5117e7632167d6bcda55d6b979167faa1cba79744282e55957e011975816b8417
-  data.tar.gz: 6de304801162205be96002493fedff35431cc37823fdc0b6f80933731fd89ae7ce15cf820be1a8e82dbb77a607e50a0900cba9604872566fac8b829d01c58fc2
+  metadata.gz: c32214124e1949acc3679157620d7dddc795a3951cbc1935626a17a9295ecb5b2ef3e4784450b3b8bd2afd3d1a910e952df298867520c452ac7aa0d1c2f637ba
+  data.tar.gz: bb1a5adacf8ad4fed75717a3a09d020297c4941ff3d518c62772a7e6139990352984732f4bcf607fb77d9295b3e447620b15135bb63c641e5f40a55535434707

data/lib/entitlements/backend/github_org/service.rb

@@ -46,7 +46,7 @@ module Entitlements
           Entitlements.logger.debug "#{identifier} add_user_to_organization(user=#{user}, org=#{org}, role=#{role})"
 
           begin
-            new_membership = Retryable.with_context(:default, not: [Octokit::NotFound]) do
+            new_membership = Retryable.with_context(:default, not: [Octokit::NotFound, Octokit::Forbidden]) do
               octokit.update_organization_membership(org, user:, role:)
             end
           rescue Octokit::NotFound => e
@@ -54,9 +54,12 @@ module Entitlements
 
             Entitlements.logger.warn "User #{user} not found in GitHub instance #{identifier}, ignoring."
             return false
-          rescue Octokit::UnprocessableEntity => e
+          rescue Octokit::UnprocessableEntity => e # code 422
             Entitlements.logger.warn "Unprocessable entity when adding #{user} to organization #{org} with role #{role}: #{e.message}. This likely means the user blocked the invite, so we're ignoring them, but someone should check it."
             return false
+          rescue Octokit::Forbidden => e # code 403
+            Entitlements.logger.warn "Forbidden from adding #{user} to organization #{org} with role #{role}: #{e.message}."
+            return false
           end
 
           # Happy path

data/lib/entitlements/backend/github_team/service.rb

@@ -363,12 +363,14 @@ module Entitlements
         def graphql_team_data(team_slug)
           cursor = nil
           team_id = nil
+          parent_team_name = nil
           result = []
           roles = {}
           sanity_counter = 0
 
-          while sanity_counter < 100
+          loop do
             sanity_counter += 1
+            raise_if_too_many_pages(sanity_counter, "members of team #{org}/#{team_slug}")
             first_str = cursor.nil? ? "first: #{max_graphql_results}" : "first: #{max_graphql_results}, after: \"#{cursor}\""
             query = "{
               organization(login: \"#{org}\") {

data/lib/entitlements/service/github.rb

@@ -15,6 +15,7 @@ module Entitlements
 
       # This is a limitation of the GitHub API
       MAX_GRAPHQL_RESULTS = 100
+      MAX_GRAPHQL_PAGES = 100
 
       # Retries to smooth over transient network blips
       MAX_GRAPHQL_RETRIES = 3
@@ -193,7 +194,7 @@ module Entitlements
         member_from_cache = Entitlements::Data::Groups::Cached.members("cn=member,#{ou}")
 
         # If we do not have *both* admins and members, we need to call the API
-        return [members_and_roles_from_rest, false] unless admin_from_cache && member_from_cache
+        return [members_and_roles_from_graphql, false] unless admin_from_cache && member_from_cache
 
         # Convert the Sets of strings into the expected hash structure.
         Entitlements.logger.debug "Loading organization members and roles for #{org} from cache"
@@ -215,8 +216,9 @@ module Entitlements
         result = {}
         sanity_counter = 0
 
-        while sanity_counter < 100
+        loop do
           sanity_counter += 1
+          raise_if_too_many_pages(sanity_counter, "organization members of #{org}")
           first_str = cursor.nil? ? "first: #{max_graphql_results}" : "first: #{max_graphql_results}, after: \"#{cursor}\""
           query = "{
             organization(login: \"#{org}\") {
@@ -294,8 +296,9 @@ module Entitlements
         result = Set.new
         sanity_counter = 0
 
-        while sanity_counter < 100
+        loop do
           sanity_counter += 1
+          raise_if_too_many_pages(sanity_counter, "pending members of #{org}")
           first_str = cursor.nil? ? "first: #{max_graphql_results}" : "first: #{max_graphql_results}, after: \"#{cursor}\""
           query = "{
             organization(login: \"#{org}\") {
@@ -378,6 +381,8 @@ module Entitlements
         request = Net::HTTP::Post.new(uri)
         request.add_field("Authorization", "bearer #{token}")
         request.add_field("Content-Type", "application/json")
+        # Lets a proxy such as entitlements-caches tie each request to a CI run.
+        request.add_field("X-Entitlements-Run-Id", ENV["GITHUB_RUN_ID"]) if ENV["GITHUB_RUN_ID"]
         request.body = JSON.generate("query" => query)
 
         begin
@@ -476,6 +481,35 @@ module Entitlements
         MAX_GRAPHQL_RESULTS
       end
       # :nocov:
+
+      # Helper method: Determine the maximum number of pages to read from a paginated
+      # GraphQL query. Stubbed in tests.
+      #
+      # Takes no arguments.
+      #
+      # Returns an Integer.
+      # :nocov:
+      Contract C::None => Integer
+      def max_graphql_pages
+        MAX_GRAPHQL_PAGES
+      end
+      # :nocov:
+
+      # Helper method: Raise rather than return a truncated result when a paginated
+      # GraphQL query needs more pages than allowed. A partial list of members would
+      # cause entitlements to skip removals for anyone not returned.
+      #
+      # page - Integer number of the page about to be requested.
+      # what - String describing what is being read, for the error message.
+      #
+      # Returns nothing.
+      Contract Integer, String => nil
+      def raise_if_too_many_pages(page, what)
+        return if page <= max_graphql_pages
+
+        Entitlements.logger.fatal "Abort reading #{what}: more than #{max_graphql_pages} pages of results"
+        raise "GraphQL pagination limit exceeded"
+      end
     end
   end
 end

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.6"
+    VERSION = "1.2.8"
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 1.2.6
+  version: 1.2.8
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-13 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts
@@ -314,7 +313,6 @@ homepage: https://github.com/github/entitlements-github-plugin
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -329,8 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: GitHub dotcom provider for entitlements-app
 test_files: []