github-actions-ingester 0.1.0__tar.gz → 0.2.1__tar.gz

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.2.1] — 2026-09-05
+
+### Added
+- Chart: `deploymentAnnotations`, for a Reloader annotation on the
+  Deployment.
+
+### Fixed
+- A read role with a name different from the schema could not resolve the
+  views by bare name, and the Grafana PostgreSQL datasource has no
+  search_path setting. After granting read access the ingester now sets
+  the database's default `search_path` to the schema (needs the ingester
+  role to own the database; skipped with a warning otherwise).
+
+## [0.2.0] — 2026-09-05
+
+### Added
+- Chart: `image.digest` renders the image as `repo:tag@digest` for
+  clusters that require digest pins.
+- Chart: `extraVolumes` and `extraVolumeMounts`, so a CA bundle can be
+  mounted for `sslmode=verify-full`.
+- `GHA_DATABASE_READ_ROLES` (chart: `database.readRoles`): existing roles
+  that get read-only access to the schema after every migration run,
+  USAGE plus SELECT on every table and view and a default privilege for
+  tables added later. Lets Grafana read through its own role instead of
+  the ingester's credentials.
+
+### Fixed
+- `examples/github-app/create-app.html` filled the `manifest` field only
+  on submit; a viewer that posts before the listener runs sent an empty
+  manifest and GitHub answered `"url" wasn't supplied`. The fields are
+  now filled on load and on every edit.
+
 ## [0.1.0] — 2026-09-05
 
 First release.

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-actions-ingester
-Version: 0.1.0
+Version: 0.2.1
 Summary: Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness.
 Project-URL: Homepage, https://github.com/danielgines/github-actions-ingester
 Project-URL: Repository, https://github.com/danielgines/github-actions-ingester
@@ -155,6 +155,19 @@ nothing. `github-actions-ingester migrate` does the same and exits, for
 init containers or pipelines that want the schema in place before the
 service starts.
 
+The ingester owns the schema and writes to it; dashboards should read
+through a role of their own. `GHA_DATABASE_READ_ROLES` names existing
+roles (comma-separated) that get USAGE on the schema and SELECT on every
+table and view after each migration run, plus a default privilege so
+tables added by later migrations are readable too. Point Grafana at the
+database with one of those roles and it never needs the ingester's
+credentials. The roles themselves are created by whoever manages the
+database (the ingester never runs `CREATE ROLE`). In the same step the
+ingester sets the database's default `search_path` to the schema, so a
+Grafana datasource (which cannot send one) resolves the views by bare
+name; that statement needs the ingester's role to own the database, and
+is skipped with a warning otherwise.
+
 ### Tables and views
 
 | Object | Content |
@@ -280,6 +293,7 @@ directory is read too; see [`.env.example`](.env.example)).
 | `GHA_DATABASE_URL` | _required_ | libpq URL, e.g. `postgresql://user:pass@host:5432/db?sslmode=require` |
 | `GHA_DATABASE_SCHEMA` | `gha` | Schema holding every table; created on first start |
 | `GHA_DATABASE_CONNECT_TIMEOUT_SECONDS` | `10` | Connection timeout |
+| `GHA_DATABASE_READ_ROLES` | `""` | Comma-separated existing roles granted read-only access to the schema on every start |
 | `GHA_POLL_INTERVAL_SECONDS` | `300` | Seconds between cycles (min 30) |
 | `GHA_BACKFILL_DAYS` | `30` | How far back the first cycle of a repository goes (1..3660) |
 | `GHA_LOOKBACK_MINUTES` | `180` | Window before the cursor re-listed every cycle to catch status changes |

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/README.md

@@ -92,6 +92,19 @@ nothing. `github-actions-ingester migrate` does the same and exits, for
 init containers or pipelines that want the schema in place before the
 service starts.
 
+The ingester owns the schema and writes to it; dashboards should read
+through a role of their own. `GHA_DATABASE_READ_ROLES` names existing
+roles (comma-separated) that get USAGE on the schema and SELECT on every
+table and view after each migration run, plus a default privilege so
+tables added by later migrations are readable too. Point Grafana at the
+database with one of those roles and it never needs the ingester's
+credentials. The roles themselves are created by whoever manages the
+database (the ingester never runs `CREATE ROLE`). In the same step the
+ingester sets the database's default `search_path` to the schema, so a
+Grafana datasource (which cannot send one) resolves the views by bare
+name; that statement needs the ingester's role to own the database, and
+is skipped with a warning otherwise.
+
 ### Tables and views
 
 | Object | Content |
@@ -217,6 +230,7 @@ directory is read too; see [`.env.example`](.env.example)).
 | `GHA_DATABASE_URL` | _required_ | libpq URL, e.g. `postgresql://user:pass@host:5432/db?sslmode=require` |
 | `GHA_DATABASE_SCHEMA` | `gha` | Schema holding every table; created on first start |
 | `GHA_DATABASE_CONNECT_TIMEOUT_SECONDS` | `10` | Connection timeout |
+| `GHA_DATABASE_READ_ROLES` | `""` | Comma-separated existing roles granted read-only access to the schema on every start |
 | `GHA_POLL_INTERVAL_SECONDS` | `300` | Seconds between cycles (min 30) |
 | `GHA_BACKFILL_DAYS` | `30` | How far back the first cycle of a repository goes (1..3660) |
 | `GHA_LOOKBACK_MINUTES` | `180` | Window before the cursor re-listed every cycle to catch status changes |

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "github-actions-ingester"
-version = "0.1.0"
+version = "0.2.1"
 description = "Standalone GitHub Actions ingester — pulls workflows, runs and jobs from the GitHub API into PostgreSQL for Grafana dashboards, FinOps and alerting. Prometheus /metrics for ingester health and scheduled-workflow liveness."
 readme = "README.md"
 requires-python = ">=3.11"

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/__init__.py

@@ -6,4 +6,4 @@ its own, and exposes Prometheus metrics about the ingestion itself and
 about the liveness of scheduled workflows.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.2.1"

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/__main__.py

@@ -152,6 +152,7 @@ def cmd_run(once: bool) -> int:
         while not stop.is_set():
             try:
                 store.migrate()
+                store.grant_read_access(settings.read_role_list())
                 break
             except Exception as exc:
                 log.error("store.bootstrap_failed", error=str(exc), retry_in=15)
@@ -200,12 +201,15 @@ def cmd_migrate() -> int:
     )
     try:
         report = store.migrate()
+        granted = store.grant_read_access(settings.read_role_list())
     finally:
         store.close()
     print(
         f"schema {settings.database_schema}: version {report.current_version}, "
         f"applied now: {report.applied or 'nothing'}"
     )
+    if granted:
+        print(f"read access granted to: {', '.join(granted)}")
     return 0
 
 

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/config.py

@@ -27,6 +27,7 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _OWNER_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
+_ROLE_RE = re.compile(r"^[a-z_][a-z0-9_]{0,62}$")
 
 
 def _split_csv(value: str) -> list[str]:
@@ -112,6 +113,14 @@ class Settings(BaseSettings):
         description="Schema that holds every ingester table. Created on first start if missing.",
     )
     database_connect_timeout_seconds: int = Field(default=10, ge=1)
+    database_read_roles: str = Field(
+        default="",
+        description="Comma-separated PostgreSQL roles that get read-only access "
+        "to the schema after every migration run: USAGE on the schema, "
+        "SELECT on every table and view, and the same SELECT on tables the "
+        "ingester creates later. Meant for the role Grafana connects with. "
+        "The roles must already exist; the ingester never creates roles.",
+    )
 
     # --- Collection ---
     poll_interval_seconds: int = Field(
@@ -250,6 +259,9 @@ class Settings(BaseSettings):
         for repo in self.repo_list():
             if not _REPO_RE.match(repo):
                 raise ValueError(f"repos entry {repo!r} must look like owner/name")
+        for role in self.read_role_list():
+            if not _ROLE_RE.match(role):
+                raise ValueError(f"database_read_roles entry {role!r} is not a plain identifier")
         if not self.org_list() and not self.repo_list():
             raise ValueError("nothing to ingest: set GHA_ORGS and/or GHA_REPOS")
         return self
@@ -267,6 +279,9 @@ class Settings(BaseSettings):
     def exclude_patterns(self) -> list[str]:
         return _split_csv(self.exclude_repos)
 
+    def read_role_list(self) -> list[str]:
+        return _split_csv(self.database_read_roles)
+
     def is_excluded(self, full_name: str) -> bool:
         name = full_name.lower()
         return any(fnmatch.fnmatchcase(name, pat.lower()) for pat in self.exclude_patterns())

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/src/github_actions_ingester/store.py

@@ -172,6 +172,73 @@ class Store:
             logger.info("store.migrations_up_to_date", version=current)
         return MigrationReport(applied_now, current, len(pending))
 
+    def grant_read_access(self, roles: Sequence[str]) -> list[str]:
+        """Give ``roles`` read-only access to the schema.
+
+        USAGE on the schema, SELECT on every table and view in it, and a
+        default privilege so tables created by later migrations are
+        readable too. Idempotent; run after every ``migrate``. The roles
+        must exist already: creating roles is the operator's job, and a
+        missing one raises like any other bootstrap error.
+        """
+        granted: list[str] = []
+        if not roles:
+            return granted
+        conn = self.connect()
+        schema = sql.Identifier(self._schema)
+        with conn.transaction(), conn.cursor() as cur:
+            for role in roles:
+                ident = sql.Identifier(role)
+                cur.execute(sql.SQL("GRANT USAGE ON SCHEMA {} TO {}").format(schema, ident))
+                cur.execute(
+                    sql.SQL("GRANT SELECT ON ALL TABLES IN SCHEMA {} TO {}").format(schema, ident)
+                )
+                cur.execute(
+                    sql.SQL(
+                        "ALTER DEFAULT PRIVILEGES IN SCHEMA {} GRANT SELECT ON TABLES TO {}"
+                    ).format(schema, ident)
+                )
+                granted.append(role)
+        logger.info("store.read_access_granted", roles=granted, schema=self._schema)
+        self._set_database_search_path()
+        return granted
+
+    def _set_database_search_path(self) -> None:
+        """Make the schema resolve by bare name for every session on the database.
+
+        The ingester sets ``search_path`` on its own connections, and a role
+        named like the schema gets it for free (``"$user"`` is first in the
+        default path), which is why the Compose example works without this.
+        A read role with a different name (``grafana`` reading schema
+        ``gha``) resolves ``minion_workflow_runs`` to nothing, and the
+        Grafana PostgreSQL datasource has no search_path setting.
+
+        ``ALTER DATABASE ... SET`` needs the database owner. When the ingester
+        is not the owner this logs and moves on: the grants above still hold,
+        and the operator can run the statement once by hand.
+        """
+        conn = self.connect()
+        try:
+            with conn.transaction(), conn.cursor() as cur:
+                cur.execute("SELECT current_database() AS db")
+                row = cur.fetchone()
+                database = row["db"] if row else ""
+                cur.execute(
+                    sql.SQL("ALTER DATABASE {} SET search_path TO {}, public").format(
+                        sql.Identifier(database), sql.Identifier(self._schema)
+                    )
+                )
+        except psycopg.errors.InsufficientPrivilege:
+            conn.rollback()
+            logger.warning(
+                "store.search_path_not_set",
+                schema=self._schema,
+                hint="ingester role does not own the database; run "
+                "ALTER DATABASE <db> SET search_path TO <schema>, public as the owner",
+            )
+            return
+        logger.info("store.search_path_set", schema=self._schema)
+
     def schema_version(self) -> int | None:
         """Highest applied migration, or None when the schema was never bootstrapped."""
         conn = self.connect()

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/tests/test_config.py

@@ -104,3 +104,11 @@ def test_normalizations() -> None:
     assert s.log_format == "console"
     assert s.jobs_filter == "latest"
     assert s.github_api_base == "https://ghe.example.com/api/v3"
+
+
+def test_read_roles_parsed_and_validated() -> None:
+    s = load_settings(github_token="x", database_read_roles=" grafana, reporting_ro ", **BASE)
+    assert s.read_role_list() == ["grafana", "reporting_ro"]
+    assert load_settings(github_token="x", **BASE).read_role_list() == []
+    with pytest.raises(ValidationError, match="plain identifier"):
+        load_settings(github_token="x", database_read_roles="grafana; drop", **BASE)

{github_actions_ingester-0.1.0 → github_actions_ingester-0.2.1}/tests/test_store.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import re
 from datetime import timedelta
 
+import psycopg
 import pytest
 
 from github_actions_ingester.store import Migration, Store, load_migrations
@@ -229,3 +231,50 @@ def _run_row(store: Store, run_id: int) -> dict[str, object]:
             return dict(cur.fetchone() or {})
     finally:
         conn.rollback()
+
+
+def test_grant_read_access_lets_a_role_read_views_and_future_tables(
+    database_url: str, migrated_store: Store
+) -> None:
+    role = "r_" + migrated_store.schema
+    with psycopg.connect(database_url, autocommit=True) as admin:
+        admin.execute(f"CREATE ROLE {role} LOGIN PASSWORD 'reader'")
+    try:
+        assert migrated_store.grant_read_access([role]) == [role]
+        # Idempotent: a second start must not fail on grants already given.
+        assert migrated_store.grant_read_access([role]) == [role]
+        # A table created by the ingester AFTER the grant is covered too
+        # (default privileges), which is what a later migration looks like.
+        with migrated_store.connect().transaction(), migrated_store.connect().cursor() as cur:
+            cur.execute("CREATE TABLE later_migration (id INT)")
+        schema = migrated_store.schema
+        reader_url = re.sub(r"//[^@]*@", f"//{role}:reader@", _with_userinfo(database_url))
+        with psycopg.connect(reader_url, autocommit=True) as reader:
+            # No SET search_path on purpose: Grafana cannot send one, so the
+            # database-level default the ingester sets must resolve the views.
+            path = reader.execute("SHOW search_path").fetchone()[0]
+            assert path.split(",")[0].strip().strip('"') == schema
+            assert reader.execute("SELECT count(*) FROM minion_workflow_runs").fetchone()[0] == 0
+            assert reader.execute("SELECT count(*) FROM workflow_jobs").fetchone()[0] == 0
+            assert reader.execute("SELECT count(*) FROM later_migration").fetchone()[0] == 0
+            with pytest.raises(psycopg.errors.InsufficientPrivilege):
+                reader.execute(
+                    "INSERT INTO repositories (id, owner, name, full_name) VALUES (1,'a','b','a/b')"
+                )
+    finally:
+        with psycopg.connect(database_url, autocommit=True) as admin:
+            admin.execute(f"DROP OWNED BY {role}")
+            admin.execute(f"DROP ROLE {role}")
+            db = admin.execute("SELECT current_database()").fetchone()[0]
+            admin.execute(f'ALTER DATABASE "{db}" RESET search_path')
+
+
+def test_grant_read_access_requires_an_existing_role(migrated_store: Store) -> None:
+    with pytest.raises(psycopg.errors.UndefinedObject):
+        migrated_store.grant_read_access(["no_such_role_" + migrated_store.schema])
+    assert migrated_store.grant_read_access([]) == []
+
+
+def _with_userinfo(url: str) -> str:
+    """pgserver URIs carry no user:pass; give the substitution something to replace."""
+    return url if "@" in url else url.replace("://", "://x:y@", 1)