github-rest-api 0.47.2__tar.gz → 0.49.0__tar.gz

github_rest_api-0.49.0/.github/workflows/auto_merge_pull_request.yaml

@@ -0,0 +1,81 @@
+name: Auto Merge PR
+on:
+  # The Claude review runs with `track_progress`, which creates its tracking
+  # comment when the review *starts* and then edits that same comment as the
+  # review progresses. The AUTO_MERGE_APPROVED marker therefore lands via an
+  # edit, so `issue_comment: created` fires far too early (the head commit is
+  # still seconds old and the marker is not written yet). Waiting for the review
+  # workflow to complete is what reliably lands after the marker exists and
+  # after the head-commit age gate has been cleared. The other PR checks
+  # are listed too because the merge gate additionally needs `mergeable_state
+  # == clean`, i.e. every check green -- whichever check finishes last is the
+  # one that makes the PR mergeable, and that is not always the review.
+  # Renaming any of these silently disables the trigger.
+  workflow_run:
+    workflows:
+      - Claude Code Review
+      - Lint Code
+      - Run Tests
+    types:
+      - completed
+  # Kept for approvals that come from a human rather than from Claude.
+  #
+  # `issue_comment: created` is deliberately absent: the only comment created on
+  # a PR here is the review's tracking comment, created seconds after the push,
+  # when the head commit is still under the age gate and the marker has not been
+  # written. It fired on every PR and could never merge anything. A marker typed
+  # by hand is picked up by the cron, or immediately via `workflow_dispatch`.
+  pull_request_review:
+    types:
+      - submitted
+  # Backstop for anything the event triggers miss.
+  schedule:
+    - cron: '0 * * * *'
+      timezone: 'America/Los_Angeles'
+  # Manual escape hatch. Run with `dry_run` to have the tool log its per-PR
+  # `Skipping auto-merge of PR #N: <reason>` verdicts without merging anything,
+  # which is the fastest way to diagnose why a PR is not being picked up.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Log eligible PRs without merging them
+        type: boolean
+        default: false
+permissions:
+  contents: write
+  pull-requests: write
+concurrency:
+  # Every run rescans all open PRs, so overlapping runs are pure duplicate work
+  # and the newest run always sees the freshest state. Do not cancel in
+  # progress: a run cancelled midway through the merge API call is worse than a
+  # redundant one.
+  group: auto-merge-pull-request
+  cancel-in-progress: false
+jobs:
+  auto_merge_pull_request:
+    # A triggering workflow that failed, was cancelled or was skipped left the
+    # PR unmergeable or wrote no marker, so there is nothing new to act on.
+    # This job checks out no PR code, so the elevated `workflow_run` context is
+    # never exposed to PR-controlled input.
+    if: |
+      github.event_name != 'workflow_run'
+      || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    # The concurrency group above serializes every run, so a hung run would
+    # block all merges until the default 6h timeout.
+    timeout-minutes: 10
+    steps:
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sudo env UV_INSTALL_DIR="/usr/local/bin" sh
+      - name: Auto Merge PR
+        # `--allowed-types` is intentionally left at the upstream default
+        # (build, chore, ci, docs, deps) so that only simple PRs auto-merge;
+        # anything substantive, `feat` and `fix` included, is merged by hand.
+        run: |
+          uvx --from github-rest-api@latest auto_merge_pull_request \
+            --authors dclong \
+            --approvers dclong 'claude[bot]' 'gemini-code-assist[bot]' \
+            --marker 'AUTO_MERGE_APPROVED' \
+            ${{ inputs.dry_run && '--dry-run' || '' }} \
+            --token ${{ secrets.ACTIONS_TOKEN }}

{github_rest_api-0.47.2 → github_rest_api-0.49.0}/.github/workflows/claude-code-review.yml

@@ -10,19 +10,25 @@ on:
     #   - "src/**/*.js"
     #   - "src/**/*.jsx"
 
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+    # Only review non-draft PRs whose branch lives in this repository. A PR from
+    # a fork is attacker-controlled input, and reviewing one with the ACTIONS_TOKEN
+    # PAT below would let a crafted title/description prompt-inject the
+    # AUTO_MERGE_APPROVED marker into a comment attributed to an auto-merge approver.
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository
+      && github.event.pull_request.draft == false
 
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
 
     steps:
@@ -36,6 +42,13 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Post the review comment with a token that has write access. Using the
+          # ACTIONS_TOKEN PAT also makes the comment (and its AUTO_MERGE_APPROVED
+          # marker) come from dclong, who is in the auto-merge approver allowlist.
+          github_token: ${{ secrets.ACTIONS_TOKEN }}
+          # Force tag mode so the action creates and updates a PR comment with the
+          # review; without this the code-review run posts nothing.
+          track_progress: true
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: |
@@ -45,12 +58,10 @@ jobs:
             When the review is finished, decide whether this PR is safe to merge
             automatically: it is safe only if the review surfaced no correctness bugs
             and no other blocking issues (non-blocking style or cleanup suggestions do
-            not disqualify it). If and only if it is safe, post a single new comment on
-            the pull request whose body includes, on its own line, this exact marker
-            (a short note such as "Approved for auto-merge." above it is fine):
-            <!-- auto-merge: approved -->
-            If you found any blocking issue, do NOT post the marker. Always post a fresh
-            comment rather than editing an existing one, so the marker's timestamp
-            follows the latest commit.
+            not disqualify it). If and only if it is safe, end your review with this
+            token alone on its own final line, exactly and verbatim:
+            AUTO_MERGE_APPROVED
+            Do not write this token anywhere else in your review, and do not write it
+            at all if you found any blocking issue.
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options

{github_rest_api-0.47.2 → github_rest_api-0.49.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-rest-api
-Version: 0.47.2
+Version: 0.49.0
 Summary: Simple wrapper of GitHub REST APIs.
 Author-email: Ben Du <longendu@yahoo.com>
 Classifier: Programming Language :: Python :: 3 :: Only

{github_rest_api-0.47.2 → github_rest_api-0.49.0}/github_rest_api/__init__.py

@@ -1,19 +1,27 @@
 """GitHub REST APIs."""
 
 from .github import (
+    UNSET,
+    IssueState,
+    IssueStateReason,
     MergeMethod,
     Organization,
     Repository,
     RepositoryType,
     SecretVisibility,
+    Unset,
     User,
 )
 
 __all__ = [
+    "UNSET",
+    "IssueState",
+    "IssueStateReason",
     "MergeMethod",
     "Organization",
     "Repository",
     "RepositoryType",
     "SecretVisibility",
+    "Unset",
     "User",
 ]