github-backup 0.65.1__tar.gz → 0.66.1__tar.gz

{github_backup-0.65.1 → github_backup-0.66.1}/CHANGES.rst

@@ -1,9 +1,161 @@
 Changelog
 =========
 
-0.65.1 (2026-08-01)
+0.66.1 (2026-11-03)
 -------------------
 ------------------------
+- Skip hooks for repositories without admin access instead of logging a
+  404 error (#532) [Rodos]
+
+  Reading hooks needs admin access, and GitHub returns 404 without it. When the
+  repository listing says the token isn't an admin, skip hooks without making the
+  request. The 404 skip message now names the repository and the permission it
+  needs, and the README note about hooks blocking starred backups is updated.
+- Chore(deps): bump pytest. [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [pytest](https://github.com/pytest-dev/pytest).
+
+
+  Updates `pytest` from 9.1.1 to 9.2.0
+  - [Release notes](https://github.com/pytest-dev/pytest/releases)
+  - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
+  - [Commits](https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0)
+
+  ---
+  updated-dependencies:
+  - dependency-name: pytest
+    dependency-version: 9.2.0
+    dependency-type: direct:production
+    update-type: version-update:semver-minor
+    dependency-group: python-packages
+  ...
+
+
+0.66.0 (2026-10-28)
+-------------------
+- List a user's private repositories when authenticated as a GitHub App.
+  [AC Capehart, Claude Opus 5.5]
+
+  With --as-app there is no authenticated user, so a user-account backup
+  fell through to /users/{user}/repos, which only returns public
+  repositories. --private silently backed up nothing private.
+
+  An installation token can list everything the installation can access
+  via /installation/repositories, private repositories included. Org
+  backups keep using /orgs/{org}/repos, and -R still fetches the single
+  repository directly.
+- Chore(deps): bump setuptools. [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [setuptools](https://github.com/pypa/setuptools).
+
+
+  Updates `setuptools` from 84.2.0 to 84.2.1
+  - [Release notes](https://github.com/pypa/setuptools/releases)
+  - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
+  - [Commits](https://github.com/pypa/setuptools/compare/v84.2.0...v84.2.1)
+
+  ---
+  updated-dependencies:
+  - dependency-name: setuptools
+    dependency-version: 84.2.1
+    dependency-type: direct:production
+    update-type: version-update:semver-patch
+    dependency-group: python-packages
+  ...
+- Chore(deps): bump setuptools. [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [setuptools](https://github.com/pypa/setuptools).
+
+
+  Updates `setuptools` from 84.0.0 to 84.2.0
+  - [Release notes](https://github.com/pypa/setuptools/releases)
+  - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
+  - [Commits](https://github.com/pypa/setuptools/compare/v84.0.0...v84.2.0)
+
+  ---
+  updated-dependencies:
+  - dependency-name: setuptools
+    dependency-version: 84.2.0
+    dependency-type: direct:production
+    update-type: version-update:semver-minor
+    dependency-group: python-packages
+  ...
+- Chore(deps): bump black. [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [black](https://github.com/psf/black).
+
+
+  Updates `black` from 26.10.0 to 26.10.1
+  - [Release notes](https://github.com/psf/black/releases)
+  - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
+  - [Commits](https://github.com/psf/black/compare/26.10.0...26.10.1)
+
+  ---
+  updated-dependencies:
+  - dependency-name: black
+    dependency-version: 26.10.1
+    dependency-type: direct:production
+    update-type: version-update:semver-patch
+    dependency-group: python-packages
+  ...
+- Chore(deps): bump black. [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [black](https://github.com/psf/black).
+
+
+  Updates `black` from 26.5.1 to 26.10.0
+  - [Release notes](https://github.com/psf/black/releases)
+  - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
+  - [Commits](https://github.com/psf/black/compare/26.5.1...26.10.0)
+
+  ---
+  updated-dependencies:
+  - dependency-name: black
+    dependency-version: 26.10.0
+    dependency-type: direct:production
+    update-type: version-update:semver-minor
+    dependency-group: python-packages
+  ...
+- Chore(deps): bump flake8 in the python-packages group.
+  [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [flake8](https://github.com/pycqa/flake8).
+
+
+  Updates `flake8` from 7.3.0 to 7.4.1
+  - [Commits](https://github.com/pycqa/flake8/compare/7.3.0...7.4.1)
+
+  ---
+  updated-dependencies:
+  - dependency-name: flake8
+    dependency-version: 7.4.1
+    dependency-type: direct:production
+    update-type: version-update:semver-minor
+    dependency-group: python-packages
+  ...
+- Chore(deps): bump setuptools in the python-packages group.
+  [dependabot[bot]]
+
+  Bumps the python-packages group with 1 update: [setuptools](https://github.com/pypa/setuptools).
+
+
+  Updates `setuptools` from 83.0.0 to 84.0.0
+  - [Release notes](https://github.com/pypa/setuptools/releases)
+  - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
+  - [Commits](https://github.com/pypa/setuptools/compare/v83.0.0...v84.0.0)
+
+  ---
+  updated-dependencies:
+  - dependency-name: setuptools
+    dependency-version: 84.0.0
+    dependency-type: direct:production
+    update-type: version-update:semver-major
+    dependency-group: python-packages
+  ...
+
+
+0.65.1 (2026-08-01)
+-------------------
 - Fix timeline not being properly incremental. [Duncan Ogilvie]
 - Chore(deps): bump twine from 6.2.0 to 7.0.0 in the python-packages
   group. [dependabot[bot]]

{github_backup-0.65.1/github_backup.egg-info → github_backup-0.66.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-backup
-Version: 0.65.1
+Version: 0.66.1
 Summary: backup a github user or organization
 Home-page: http://github.com/josegonzalez/python-github-backup
 Author: Jose Diaz-Gonzalez
@@ -229,6 +229,8 @@ GitHub Apps
 
 GitHub Apps are ideal for organization backups in CI/CD. Tokens are scoped to specific repositories and expire after 1 hour.
 
+For a user account (no ``--organization``), ``--as-app`` lists the repositories the installation can access, so private repositories are included.
+
 **One-time setup:**
 
 1. Create a GitHub App at *Settings -> Developer Settings -> GitHub Apps -> New GitHub App*
@@ -435,11 +437,9 @@ If the incremental argument is used, per-resource checkpoints are only advanced
 
 It's therefore recommended to only use the incremental argument if the output/result is being actively monitored, or complimented with periodic full non-incremental runs, to avoid unexpected missing data in a regular backup runs.
 
-**Starred public repo hooks blocking**
-
-Since the ``--all`` argument includes ``--hooks``, if you use ``--all`` and ``--all-starred`` together to clone a users starred public repositories, the backup will likely error and block the backup continuing.
+**Hooks need admin access**
 
-This is due to needing the correct permission for ``--hooks`` on public repos.
+Reading a repository's hooks requires admin access to it, and fine-grained tokens also need the Webhooks read permission. Since the ``--all`` argument includes ``--hooks``, repositories you don't administer, such as starred repositories with ``--all-starred``, are skipped for hooks and the rest of the backup continues.
 
 
 "bare" is actually "mirror"

{github_backup-0.65.1 → github_backup-0.66.1}/README

@@ -199,6 +199,8 @@ GitHub Apps
 
 GitHub Apps are ideal for organization backups in CI/CD. Tokens are scoped to specific repositories and expire after 1 hour.
 
+For a user account (no ``--organization``), ``--as-app`` lists the repositories the installation can access, so private repositories are included.
+
 **One-time setup:**
 
 1. Create a GitHub App at *Settings -> Developer Settings -> GitHub Apps -> New GitHub App*
@@ -405,11 +407,9 @@ If the incremental argument is used, per-resource checkpoints are only advanced
 
 It's therefore recommended to only use the incremental argument if the output/result is being actively monitored, or complimented with periodic full non-incremental runs, to avoid unexpected missing data in a regular backup runs.
 
-**Starred public repo hooks blocking**
-
-Since the ``--all`` argument includes ``--hooks``, if you use ``--all`` and ``--all-starred`` together to clone a users starred public repositories, the backup will likely error and block the backup continuing.
+**Hooks need admin access**
 
-This is due to needing the correct permission for ``--hooks`` on public repos.
+Reading a repository's hooks requires admin access to it, and fine-grained tokens also need the Webhooks read permission. Since the ``--all`` argument includes ``--hooks``, repositories you don't administer, such as starred repositories with ``--all-starred``, are skipped for hooks and the rest of the backup continues.
 
 
 "bare" is actually "mirror"

{github_backup-0.65.1 → github_backup-0.66.1}/README.rst

@@ -199,6 +199,8 @@ GitHub Apps
 
 GitHub Apps are ideal for organization backups in CI/CD. Tokens are scoped to specific repositories and expire after 1 hour.
 
+For a user account (no ``--organization``), ``--as-app`` lists the repositories the installation can access, so private repositories are included.
+
 **One-time setup:**
 
 1. Create a GitHub App at *Settings -> Developer Settings -> GitHub Apps -> New GitHub App*
@@ -405,11 +407,9 @@ If the incremental argument is used, per-resource checkpoints are only advanced
 
 It's therefore recommended to only use the incremental argument if the output/result is being actively monitored, or complimented with periodic full non-incremental runs, to avoid unexpected missing data in a regular backup runs.
 
-**Starred public repo hooks blocking**
-
-Since the ``--all`` argument includes ``--hooks``, if you use ``--all`` and ``--all-starred`` together to clone a users starred public repositories, the backup will likely error and block the backup continuing.
+**Hooks need admin access**
 
-This is due to needing the correct permission for ``--hooks`` on public repos.
+Reading a repository's hooks requires admin access to it, and fine-grained tokens also need the Webhooks read permission. Since the ``--all`` argument includes ``--hooks``, repositories you don't administer, such as starred repositories with ``--all-starred``, are skipped for hooks and the rest of the backup continues.
 
 
 "bare" is actually "mirror"

github_backup-0.66.1/github_backup/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.66.1"

{github_backup-0.65.1 → github_backup-0.66.1}/github_backup/github_backup.py

@@ -1838,6 +1838,11 @@ def retrieve_repositories(args, authenticated_user):
     if args.user == authenticated_user["login"]:
         # we must use the /user/repos API to be able to access private repos
         template = "https://{0}/user/repos".format(get_github_api_host(args))
+    elif args.as_app and not args.organization:
+        # /users/{user}/repos is public-only; the installation sees private repos too
+        template = "https://{0}/installation/repositories".format(
+            get_github_api_host(args)
+        )
     else:
         if args.private and not args.organization:
             logger.warning(
@@ -1868,6 +1873,10 @@ def retrieve_repositories(args, authenticated_user):
             logger.warning(f"Legal notice: {e.legal_url}")
         return []
 
+    if template.endswith("/installation/repositories"):
+        # Each page is {"total_count": ..., "repositories": [...]}
+        repos = [repo for page in repos for repo in page["repositories"]]
+
     return retrieve_additional_repositories(args, authenticated_user, repos)
 
 
@@ -3146,6 +3155,15 @@ def backup_hooks(args, repo_cwd, repository, repos_template):
     if not auth:
         logger.info("Skipping hooks since no authentication provided")
         return
+    # Reading hooks needs admin access, and GitHub returns 404 without it.
+    # Skip the request when the repository listing says we aren't an admin.
+    if repository.get("permissions", {}).get("admin") is False:
+        logger.info(
+            "Skipping hooks for {0} since admin access is required".format(
+                repository["full_name"]
+            )
+        )
+        return
     hook_cwd = os.path.join(repo_cwd, "hooks")
     output_file = "{0}/hooks.json".format(hook_cwd)
     template = "{0}/{1}/hooks".format(repos_template, repository["full_name"])
@@ -3153,7 +3171,12 @@ def backup_hooks(args, repo_cwd, repository, repos_template):
         _backup_data(args, "hooks", template, output_file, hook_cwd)
     except HTTPError as e:
         if e.code == 404:
-            logger.info("Unable to read hooks, skipping")
+            logger.info(
+                "Unable to read hooks for {0}, skipping (requires admin access, "
+                "or Webhooks read permission for fine-grained tokens)".format(
+                    repository["full_name"]
+                )
+            )
         else:
             raise e
 

{github_backup-0.65.1 → github_backup-0.66.1/github_backup.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-backup
-Version: 0.65.1
+Version: 0.66.1
 Summary: backup a github user or organization
 Home-page: http://github.com/josegonzalez/python-github-backup
 Author: Jose Diaz-Gonzalez
@@ -229,6 +229,8 @@ GitHub Apps
 
 GitHub Apps are ideal for organization backups in CI/CD. Tokens are scoped to specific repositories and expire after 1 hour.
 
+For a user account (no ``--organization``), ``--as-app`` lists the repositories the installation can access, so private repositories are included.
+
 **One-time setup:**
 
 1. Create a GitHub App at *Settings -> Developer Settings -> GitHub Apps -> New GitHub App*
@@ -435,11 +437,9 @@ If the incremental argument is used, per-resource checkpoints are only advanced
 
 It's therefore recommended to only use the incremental argument if the output/result is being actively monitored, or complimented with periodic full non-incremental runs, to avoid unexpected missing data in a regular backup runs.
 
-**Starred public repo hooks blocking**
-
-Since the ``--all`` argument includes ``--hooks``, if you use ``--all`` and ``--all-starred`` together to clone a users starred public repositories, the backup will likely error and block the backup continuing.
+**Hooks need admin access**
 
-This is due to needing the correct permission for ``--hooks`` on public repos.
+Reading a repository's hooks requires admin access to it, and fine-grained tokens also need the Webhooks read permission. Since the ``--all`` argument includes ``--hooks``, repositories you don't administer, such as starred repositories with ``--all-starred``, are skipped for hooks and the rest of the backup continues.
 
 
 "bare" is actually "mirror"

{github_backup-0.65.1 → github_backup-0.66.1}/github_backup.egg-info/SOURCES.txt

@@ -18,12 +18,14 @@ github_backup.egg-info/entry_points.txt
 github_backup.egg-info/top_level.txt
 github_backup.egg-info/zip-safe
 tests/test_all_starred.py
+tests/test_app_repositories.py
 tests/test_attachments.py
 tests/test_auth.py
 tests/test_case_sensitivity.py
 tests/test_disabled_issues_pulls.py
 tests/test_discussions.py
 tests/test_gists.py
+tests/test_hooks.py
 tests/test_http_451.py
 tests/test_incremental_per_repository.py
 tests/test_issue_timeline.py

{github_backup-0.65.1 → github_backup-0.66.1}/release-requirements.txt

@@ -1,15 +1,15 @@
 # Linting & Formatting
 autopep8==2.3.2
-black==26.5.1
-flake8==7.3.0
+black==26.10.1
+flake8==7.4.1
 
 # Testing
-pytest==9.1.1
+pytest==9.2.0
 
 # Release & Publishing
 twine==7.0.0
 gitchangelog==3.0.4
-setuptools==83.0.0
+setuptools==84.2.1
 
 # Documentation
 restructuredtext-lint==2.0.2

github_backup-0.66.1/tests/test_app_repositories.py

@@ -0,0 +1,71 @@
+"""Tests for listing a user's repositories with a GitHub App installation token."""
+
+from unittest.mock import patch
+
+import pytest
+
+from github_backup import github_backup
+
+NO_USER = {"login": None}
+
+
+def page(*names):
+    return {
+        "total_count": 3,
+        "repositories": [{"name": name, "private": True} for name in names],
+    }
+
+
+@pytest.fixture
+def mock_retrieve_data():
+    with patch("github_backup.github_backup.retrieve_data") as mock:
+        yield mock
+
+
+def test_app_lists_user_repositories_from_installation(create_args, mock_retrieve_data):
+    args = create_args(as_app=True, include_repository=True)
+    mock_retrieve_data.return_value = [page("a", "b"), page("c")]
+
+    repos = github_backup.retrieve_repositories(args, NO_USER)
+
+    assert mock_retrieve_data.call_args.args[1] == (
+        "https://api.github.com/installation/repositories"
+    )
+    assert [r["name"] for r in repos] == ["a", "b", "c"]
+
+
+def test_app_installation_listing_uses_ghes_host(create_args, mock_retrieve_data):
+    args = create_args(
+        as_app=True, include_repository=True, github_host="ghe.example.com"
+    )
+    mock_retrieve_data.return_value = [page("a")]
+
+    github_backup.retrieve_repositories(args, NO_USER)
+
+    assert mock_retrieve_data.call_args.args[1] == (
+        "https://ghe.example.com/api/v3/installation/repositories"
+    )
+
+
+def test_app_organization_still_lists_org_repositories(create_args, mock_retrieve_data):
+    args = create_args(as_app=True, include_repository=True, organization=True)
+    mock_retrieve_data.return_value = [{"name": "a"}]
+
+    repos = github_backup.retrieve_repositories(args, NO_USER)
+
+    assert mock_retrieve_data.call_args.args[1] == (
+        "https://api.github.com/orgs/testuser/repos"
+    )
+    assert repos == [{"name": "a"}]
+
+
+def test_app_single_repository_is_fetched_directly(create_args, mock_retrieve_data):
+    args = create_args(as_app=True, repository="dotfiles")
+    mock_retrieve_data.return_value = [{"name": "dotfiles"}]
+
+    repos = github_backup.retrieve_repositories(args, NO_USER)
+
+    assert mock_retrieve_data.call_args.args[1] == (
+        "https://api.github.com/repos/testuser/dotfiles"
+    )
+    assert repos == [{"name": "dotfiles"}]

github_backup-0.66.1/tests/test_hooks.py

@@ -0,0 +1,96 @@
+"""Tests for hooks backup permissions (GitHub issue #532).
+
+Reading ``/repos/{owner}/{repo}/hooks`` needs admin access to the repository.
+Without it GitHub responds with HTTP 404 rather than 403, which used to log an
+API error for every repository the user doesn't administer.
+"""
+
+import logging
+from urllib.error import HTTPError
+
+import pytest
+
+from github_backup import github_backup
+
+REPOS_TEMPLATE = "https://api.github.com/repos"
+
+
+@pytest.fixture
+def hook_args(create_args):
+    return create_args(include_hooks=True, token_classic="ghp_token")
+
+
+def _repository(**fields):
+    return {"full_name": "owner/repo", **fields}
+
+
+def test_hooks_skipped_without_request_when_not_admin(
+    hook_args, tmp_path, monkeypatch, caplog
+):
+    def fail_retrieve_data(*args, **kwargs):
+        raise AssertionError("hooks should not be requested without admin access")
+
+    monkeypatch.setattr(github_backup, "retrieve_data", fail_retrieve_data)
+
+    with caplog.at_level(logging.INFO, logger=github_backup.logger.name):
+        github_backup.backup_hooks(
+            hook_args,
+            tmp_path,
+            _repository(permissions={"admin": False, "push": True, "pull": True}),
+            REPOS_TEMPLATE,
+        )
+
+    assert "Skipping hooks for owner/repo since admin access is required" in caplog.text
+    assert not (tmp_path / "hooks").exists()
+
+
+@pytest.mark.parametrize(
+    "repository",
+    [
+        _repository(permissions={"admin": True, "push": True, "pull": True}),
+        _repository(),
+    ],
+    ids=["admin", "no-permissions-field"],
+)
+def test_hooks_requested_when_admin_or_permissions_unknown(
+    hook_args, tmp_path, monkeypatch, repository
+):
+    requested = []
+
+    def fake_retrieve_data(passed_args, template, *args, **kwargs):
+        requested.append(template)
+        return [{"id": 1, "name": "web"}]
+
+    monkeypatch.setattr(github_backup, "retrieve_data", fake_retrieve_data)
+
+    github_backup.backup_hooks(hook_args, tmp_path, repository, REPOS_TEMPLATE)
+
+    assert requested == ["https://api.github.com/repos/owner/repo/hooks"]
+    assert (tmp_path / "hooks" / "hooks.json").exists()
+
+
+def test_hooks_404_is_skipped_with_reason(hook_args, tmp_path, monkeypatch, caplog):
+    def fake_retrieve_data(passed_args, template, *args, **kwargs):
+        raise HTTPError(template, 404, "Not Found", hdrs=None, fp=None)
+
+    monkeypatch.setattr(github_backup, "retrieve_data", fake_retrieve_data)
+
+    with caplog.at_level(logging.INFO, logger=github_backup.logger.name):
+        github_backup.backup_hooks(
+            hook_args,
+            tmp_path,
+            _repository(permissions={"admin": True}),
+            REPOS_TEMPLATE,
+        )
+
+    assert "Unable to read hooks for owner/repo, skipping" in caplog.text
+
+
+def test_hooks_non_404_error_propagates(hook_args, tmp_path, monkeypatch):
+    def fake_retrieve_data(passed_args, template, *args, **kwargs):
+        raise HTTPError(template, 500, "Server Error", hdrs=None, fp=None)
+
+    monkeypatch.setattr(github_backup, "retrieve_data", fake_retrieve_data)
+
+    with pytest.raises(HTTPError):
+        github_backup.backup_hooks(hook_args, tmp_path, _repository(), REPOS_TEMPLATE)

github_backup-0.65.1/github_backup/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.65.1"