github-agent 2.4.2__tar.gz → 2.4.3__tar.gz

{github_agent-2.4.2 → github_agent-2.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.2
+Version: 2.4.3
 Summary: GitHub Agent for MCP
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -45,7 +45,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.3*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

{github_agent-2.4.2 → github_agent-2.4.3}/README.md

@@ -20,7 +20,7 @@
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.3*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

github_agent-2.4.3/github_agent/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.4.3"

{github_agent-2.4.2 → github_agent-2.4.3}/github_agent/github_http.py

@@ -4,21 +4,23 @@ from __future__ import annotations
 
 import http.client
 import json
-import os
 import ssl
 from typing import Any
 
+from agent_connector_sdk.tls.errors import TransportSecurityError
+from agent_connector_sdk.tls.profile import ResolvedTLSProfile
+from agent_connector_sdk.tls.resolve import resolve_tls_profile
+
 GITHUB_API_HOST = "api.github.com"
 MAX_REQUEST_BYTES = 1 * 1024 * 1024
 MAX_RESPONSE_BYTES = 8 * 1024 * 1024
 
 
-def _tls_context() -> ssl.SSLContext:
-    cafile = os.environ.get("SSL_CERT_FILE") or os.environ.get("REQUESTS_CA_BUNDLE")
-    capath = os.environ.get("SSL_CERT_DIR")
+def _tls_profile() -> ResolvedTLSProfile:
+    """Resolve the GitHub TLS profile from the SDK (SDK-CONNECTOR-CONTROL-R017)."""
     try:
-        return ssl.create_default_context(cafile=cafile or None, capath=capath or None)
-    except (OSError, ssl.SSLError):
+        return resolve_tls_profile("github")
+    except TransportSecurityError:
         raise RuntimeError("runtime TLS trust configuration is invalid") from None
 
 
@@ -103,11 +105,12 @@ def github_json_request(
     _validate_token_shape(token)
     body = _encode_request_body(payload)
     headers = _request_headers(token)
+    profile = _tls_profile()
     connection = http.client.HTTPSConnection(
         GITHUB_API_HOST,
         443,
         timeout=30,
-        context=_tls_context(),
+        context=profile.ssl_context,
     )
     try:
         connection.request(method, path, body=body, headers=headers)
@@ -118,3 +121,4 @@ def github_json_request(
         raise RuntimeError("GitHub service is unavailable") from None
     finally:
         connection.close()
+        profile.cleanup()

{github_agent-2.4.2 → github_agent-2.4.3}/github_agent/mcp_server.py

@@ -39,7 +39,7 @@ from github_agent.auth import (
 )
 from github_agent.github_response_models import PagesAlreadyEnabled, PagesNotEnabled
 
-__version__ = "2.4.2"
+__version__ = "2.4.3"
 logger = get_logger("GithubMCPServer")
 logger.setLevel(logging.INFO)
 

{github_agent-2.4.2 → github_agent-2.4.3}/github_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-agent
-Version: 2.4.2
+Version: 2.4.3
 Summary: GitHub Agent for MCP
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -45,7 +45,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/github-agent)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/github-agent)
 
-*Version: 2.4.2*
+*Version: 2.4.3*
 
 > **Documentation** — Installation, deployment, and usage across the MCP, API, and
 > [official documentation](https://knuckles-team.github.io/github-agent/).

{github_agent-2.4.2 → github_agent-2.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "github-agent"
-version = "2.4.2"
+version = "2.4.3"
 readme = "README.md"
 description = "GitHub Agent for MCP"
 requires-python = ">=3.12"

{github_agent-2.4.2 → github_agent-2.4.3}/tests/test_github_http.py

@@ -163,3 +163,68 @@ def test_github_json_request_encodes_payload_as_compact_json():
     assert value == {"created": True}
     sent_kwargs = connection.request.call_args.kwargs
     assert sent_kwargs["body"] == json.dumps({"title": "hi"}, separators=(",", ":")).encode()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_request_uses_sdk_tls_profile_context():
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: the connection uses the profile's context."""
+    connection, _ = _mock_connection()
+    profile = MagicMock()
+    with (
+        patch("github_agent.github_http.resolve_tls_profile", return_value=profile) as resolve,
+        patch("github_agent.github_http.http.client.HTTPSConnection", return_value=connection) as conn_cls,
+    ):
+        github_json_request("GET", "/repos/x/y", "tok")
+    resolve.assert_called_once_with("github")
+    assert conn_cls.call_args.kwargs["context"] is profile.ssl_context
+    profile.cleanup.assert_called_once()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_private_ca_is_carried_through_the_profile(tmp_path, monkeypatch):
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: a configured CA bundle reaches the profile."""
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec
+    import datetime
+
+    from github_agent.github_http import _tls_profile
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(x509.oid.NameOID.COMMON_NAME, "test-ca")])
+    now = datetime.datetime.now(datetime.timezone.utc)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(name)
+        .issuer_name(name)
+        .public_key(key.public_key())
+        .serial_number(1)
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(key, hashes.SHA256())
+    )
+    ca = tmp_path / "ca.pem"
+    ca.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    monkeypatch.setenv("GITHUB_CA_BUNDLE", str(ca))
+    profile = _tls_profile()
+    try:
+        assert profile.ca_bundle_path == ca
+        assert profile.verify_enabled
+    finally:
+        profile.cleanup()
+
+
+@pytest.mark.spec("CONN-GITHUB-AGENT-TRANSPORT-TLS-R001")
+def test_no_hand_built_ssl_context_remains():
+    """CONN-GITHUB-AGENT-TRANSPORT-TLS-R001: no package code builds its own context."""
+    from pathlib import Path
+
+    import github_agent
+
+    root = Path(github_agent.__file__).parent
+    for path in root.rglob("*.py"):
+        text = path.read_text(encoding="utf-8")
+        assert "create_default_context" not in text, path
+        assert "verify=False" not in text, path
+        assert "disable_warnings" not in text, path

github_agent-2.4.2/github_agent/__init__.py

@@ -1 +0,0 @@
-__version__ = "2.4.2"