github-actions-ingester 0.1.0__tar.gz → 0.2.0__tar.gz

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.2.0] — 2026-09-05
+
+### Added
+- Chart: `image.digest` renders the image as `repo:tag@digest` for
+  clusters that require digest pins.
+- Chart: `extraVolumes` and `extraVolumeMounts`, so a CA bundle can be
+  mounted for `sslmode=verify-full`.
+- `GHA_DATABASE_READ_ROLES` (chart: `database.readRoles`): existing roles
+  that get read-only access to the schema after every migration run,
+  USAGE plus SELECT on every table and view and a default privilege for
+  tables added later. Lets Grafana read through its own role instead of
+  the ingester's credentials.
+
+### Fixed
+- `examples/github-app/create-app.html` filled the `manifest` field only
+  on submit; a viewer that posts before the listener runs sent an empty
+  manifest and GitHub answered `"url" wasn't supplied`. The fields are
+  now filled on load and on every edit.
+
 ## [0.1.0] — 2026-09-05
 
 First release.

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-actions-ingester
-Version: 0.1.0
+Version: 0.2.0
 Summary: Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness.
 Project-URL: Homepage, https://github.com/danielgines/github-actions-ingester
 Project-URL: Repository, https://github.com/danielgines/github-actions-ingester
@@ -155,6 +155,15 @@ nothing. `github-actions-ingester migrate` does the same and exits, for
 init containers or pipelines that want the schema in place before the
 service starts.
 
+The ingester owns the schema and writes to it; dashboards should read
+through a role of their own. `GHA_DATABASE_READ_ROLES` names existing
+roles (comma-separated) that get USAGE on the schema and SELECT on every
+table and view after each migration run, plus a default privilege so
+tables added by later migrations are readable too. Point Grafana at the
+database with one of those roles and it never needs the ingester's
+credentials. The roles themselves are created by whoever manages the
+database (the ingester never runs `CREATE ROLE`).
+
 ### Tables and views
 
 | Object | Content |
@@ -280,6 +289,7 @@ directory is read too; see [`.env.example`](.env.example)).
 | `GHA_DATABASE_URL` | _required_ | libpq URL, e.g. `postgresql://user:pass@host:5432/db?sslmode=require` |
 | `GHA_DATABASE_SCHEMA` | `gha` | Schema holding every table; created on first start |
 | `GHA_DATABASE_CONNECT_TIMEOUT_SECONDS` | `10` | Connection timeout |
+| `GHA_DATABASE_READ_ROLES` | `""` | Comma-separated existing roles granted read-only access to the schema on every start |
 | `GHA_POLL_INTERVAL_SECONDS` | `300` | Seconds between cycles (min 30) |
 | `GHA_BACKFILL_DAYS` | `30` | How far back the first cycle of a repository goes (1..3660) |
 | `GHA_LOOKBACK_MINUTES` | `180` | Window before the cursor re-listed every cycle to catch status changes |

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/README.md

@@ -92,6 +92,15 @@ nothing. `github-actions-ingester migrate` does the same and exits, for
 init containers or pipelines that want the schema in place before the
 service starts.
 
+The ingester owns the schema and writes to it; dashboards should read
+through a role of their own. `GHA_DATABASE_READ_ROLES` names existing
+roles (comma-separated) that get USAGE on the schema and SELECT on every
+table and view after each migration run, plus a default privilege so
+tables added by later migrations are readable too. Point Grafana at the
+database with one of those roles and it never needs the ingester's
+credentials. The roles themselves are created by whoever manages the
+database (the ingester never runs `CREATE ROLE`).
+
 ### Tables and views
 
 | Object | Content |
@@ -217,6 +226,7 @@ directory is read too; see [`.env.example`](.env.example)).
 | `GHA_DATABASE_URL` | _required_ | libpq URL, e.g. `postgresql://user:pass@host:5432/db?sslmode=require` |
 | `GHA_DATABASE_SCHEMA` | `gha` | Schema holding every table; created on first start |
 | `GHA_DATABASE_CONNECT_TIMEOUT_SECONDS` | `10` | Connection timeout |
+| `GHA_DATABASE_READ_ROLES` | `""` | Comma-separated existing roles granted read-only access to the schema on every start |
 | `GHA_POLL_INTERVAL_SECONDS` | `300` | Seconds between cycles (min 30) |
 | `GHA_BACKFILL_DAYS` | `30` | How far back the first cycle of a repository goes (1..3660) |
 | `GHA_LOOKBACK_MINUTES` | `180` | Window before the cursor re-listed every cycle to catch status changes |

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "github-actions-ingester"
-version = "0.1.0"
+version = "0.2.0"
 description = "Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness."
 readme = "README.md"
 requires-python = ">=3.11"

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/src/github_actions_ingester/__init__.py

@@ -6,4 +6,4 @@ its own, and exposes Prometheus metrics about the ingestion itself and
 about the liveness of scheduled workflows.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/src/github_actions_ingester/__main__.py

@@ -152,6 +152,7 @@ def cmd_run(once: bool) -> int:
         while not stop.is_set():
             try:
                 store.migrate()
+                store.grant_read_access(settings.read_role_list())
                 break
             except Exception as exc:
                 log.error("store.bootstrap_failed", error=str(exc), retry_in=15)
@@ -200,12 +201,15 @@ def cmd_migrate() -> int:
     )
     try:
         report = store.migrate()
+        granted = store.grant_read_access(settings.read_role_list())
     finally:
         store.close()
     print(
         f"schema {settings.database_schema}: version {report.current_version}, "
         f"applied now: {report.applied or 'nothing'}"
     )
+    if granted:
+        print(f"read access granted to: {', '.join(granted)}")
     return 0
 
 

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/src/github_actions_ingester/config.py

@@ -27,6 +27,7 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _OWNER_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
+_ROLE_RE = re.compile(r"^[a-z_][a-z0-9_]{0,62}$")
 
 
 def _split_csv(value: str) -> list[str]:
@@ -112,6 +113,14 @@ class Settings(BaseSettings):
         description="Schema that holds every ingester table. Created on first start if missing.",
     )
     database_connect_timeout_seconds: int = Field(default=10, ge=1)
+    database_read_roles: str = Field(
+        default="",
+        description="Comma-separated PostgreSQL roles that get read-only access "
+        "to the schema after every migration run: USAGE on the schema, "
+        "SELECT on every table and view, and the same SELECT on tables the "
+        "ingester creates later. Meant for the role Grafana connects with. "
+        "The roles must already exist; the ingester never creates roles.",
+    )
 
     # --- Collection ---
     poll_interval_seconds: int = Field(
@@ -250,6 +259,9 @@ class Settings(BaseSettings):
         for repo in self.repo_list():
             if not _REPO_RE.match(repo):
                 raise ValueError(f"repos entry {repo!r} must look like owner/name")
+        for role in self.read_role_list():
+            if not _ROLE_RE.match(role):
+                raise ValueError(f"database_read_roles entry {role!r} is not a plain identifier")
         if not self.org_list() and not self.repo_list():
             raise ValueError("nothing to ingest: set GHA_ORGS and/or GHA_REPOS")
         return self
@@ -267,6 +279,9 @@ class Settings(BaseSettings):
     def exclude_patterns(self) -> list[str]:
         return _split_csv(self.exclude_repos)
 
+    def read_role_list(self) -> list[str]:
+        return _split_csv(self.database_read_roles)
+
     def is_excluded(self, full_name: str) -> bool:
         name = full_name.lower()
         return any(fnmatch.fnmatchcase(name, pat.lower()) for pat in self.exclude_patterns())

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/src/github_actions_ingester/store.py

@@ -172,6 +172,36 @@ class Store:
             logger.info("store.migrations_up_to_date", version=current)
         return MigrationReport(applied_now, current, len(pending))
 
+    def grant_read_access(self, roles: Sequence[str]) -> list[str]:
+        """Give ``roles`` read-only access to the schema.
+
+        USAGE on the schema, SELECT on every table and view in it, and a
+        default privilege so tables created by later migrations are
+        readable too. Idempotent; run after every ``migrate``. The roles
+        must exist already: creating roles is the operator's job, and a
+        missing one raises like any other bootstrap error.
+        """
+        granted: list[str] = []
+        if not roles:
+            return granted
+        conn = self.connect()
+        schema = sql.Identifier(self._schema)
+        with conn.transaction(), conn.cursor() as cur:
+            for role in roles:
+                ident = sql.Identifier(role)
+                cur.execute(sql.SQL("GRANT USAGE ON SCHEMA {} TO {}").format(schema, ident))
+                cur.execute(
+                    sql.SQL("GRANT SELECT ON ALL TABLES IN SCHEMA {} TO {}").format(schema, ident)
+                )
+                cur.execute(
+                    sql.SQL(
+                        "ALTER DEFAULT PRIVILEGES IN SCHEMA {} GRANT SELECT ON TABLES TO {}"
+                    ).format(schema, ident)
+                )
+                granted.append(role)
+        logger.info("store.read_access_granted", roles=granted, schema=self._schema)
+        return granted
+
     def schema_version(self) -> int | None:
         """Highest applied migration, or None when the schema was never bootstrapped."""
         conn = self.connect()

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/tests/test_config.py

@@ -104,3 +104,11 @@ def test_normalizations() -> None:
     assert s.log_format == "console"
     assert s.jobs_filter == "latest"
     assert s.github_api_base == "https://ghe.example.com/api/v3"
+
+
+def test_read_roles_parsed_and_validated() -> None:
+    s = load_settings(github_token="x", database_read_roles=" grafana, reporting_ro ", **BASE)
+    assert s.read_role_list() == ["grafana", "reporting_ro"]
+    assert load_settings(github_token="x", **BASE).read_role_list() == []
+    with pytest.raises(ValidationError, match="plain identifier"):
+        load_settings(github_token="x", database_read_roles="grafana; drop", **BASE)

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.0}/tests/test_store.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import re
 from datetime import timedelta
 
+import psycopg
 import pytest
 
 from github_actions_ingester.store import Migration, Store, load_migrations
@@ -229,3 +231,45 @@ def _run_row(store: Store, run_id: int) -> dict[str, object]:
             return dict(cur.fetchone() or {})
     finally:
         conn.rollback()
+
+
+def test_grant_read_access_lets_a_role_read_views_and_future_tables(
+    database_url: str, migrated_store: Store
+) -> None:
+    role = "r_" + migrated_store.schema
+    with psycopg.connect(database_url, autocommit=True) as admin:
+        admin.execute(f"CREATE ROLE {role} LOGIN PASSWORD 'reader'")
+    try:
+        assert migrated_store.grant_read_access([role]) == [role]
+        # Idempotent: a second start must not fail on grants already given.
+        assert migrated_store.grant_read_access([role]) == [role]
+        # A table created by the ingester AFTER the grant is covered too
+        # (default privileges), which is what a later migration looks like.
+        with migrated_store.connect().transaction(), migrated_store.connect().cursor() as cur:
+            cur.execute("CREATE TABLE later_migration (id INT)")
+        schema = migrated_store.schema
+        reader_url = re.sub(r"//[^@]*@", f"//{role}:reader@", _with_userinfo(database_url))
+        with psycopg.connect(reader_url, autocommit=True) as reader:
+            reader.execute(f"SET search_path TO {schema}")
+            assert reader.execute("SELECT count(*) FROM minion_workflow_runs").fetchone()[0] == 0
+            assert reader.execute("SELECT count(*) FROM workflow_jobs").fetchone()[0] == 0
+            assert reader.execute("SELECT count(*) FROM later_migration").fetchone()[0] == 0
+            with pytest.raises(psycopg.errors.InsufficientPrivilege):
+                reader.execute(
+                    "INSERT INTO repositories (id, owner, name, full_name) VALUES (1,'a','b','a/b')"
+                )
+    finally:
+        with psycopg.connect(database_url, autocommit=True) as admin:
+            admin.execute(f"DROP OWNED BY {role}")
+            admin.execute(f"DROP ROLE {role}")
+
+
+def test_grant_read_access_requires_an_existing_role(migrated_store: Store) -> None:
+    with pytest.raises(psycopg.errors.UndefinedObject):
+        migrated_store.grant_read_access(["no_such_role_" + migrated_store.schema])
+    assert migrated_store.grant_read_access([]) == []
+
+
+def _with_userinfo(url: str) -> str:
+    """pgserver URIs carry no user:pass; give the substitution something to replace."""
+    return url if "@" in url else url.replace("://", "://x:y@", 1)