imbi-plugin-github 0.1.0__tar.gz

imbi_plugin_github-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: Publish to PyPI
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Set up Python
+        run: uv python install 3.14
+
+      - name: Build
+        run: uv build
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@release/v1

imbi_plugin_github-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,54 @@
+name: Testing
+on:
+  pull_request:
+  push:
+    branches: [ "main" ]
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+    tags-ignore: [ "*" ]
+
+jobs:
+  lint:
+    name: "Static Analysis"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Run linters
+        run: just lint
+
+  test:
+    name: "Automated Tests"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: [ "3.14" ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "${{ matrix.python }}"
+          enable-cache: true
+      - name: Test with python ${{ matrix.python }}
+        run: just test
+      - name: Upload Coverage
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./build/coverage.xml
+          flags: unittests

imbi_plugin_github-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+.ruff_cache/

imbi_plugin_github-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,36 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: debug-statements
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.6
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/tombi-toml/tombi-pre-commit
+    rev: v0.7.25
+    hooks:
+      - id: tombi-format
+
+  - repo: local
+    hooks:
+      - id: basedpyright
+        name: basedpyright
+        language: system
+        types: [python]
+        pass_filenames: false
+        entry: uv
+        args:
+          - run
+          - basedpyright
+          - src

imbi_plugin_github-0.1.0/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, Imbi
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

imbi_plugin_github-0.1.0/PKG-INFO

@@ -0,0 +1,52 @@
+Metadata-Version: 2.4
+Name: imbi-plugin-github
+Version: 0.1.0
+Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
+Author-email: "Gavin M. Roy" <gavinr@aweber.com>
+License: BSD-3-Clause
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.14
+Requires-Dist: httpx>=0.27
+Requires-Dist: imbi-common>=0.8.4
+Requires-Dist: pydantic>=2
+Description-Content-Type: text/markdown
+
+# imbi-plugin-github
+
+GitHub identity plugin for Imbi. Ships three entry points so the admin UI
+can distinguish github.com, GitHub Enterprise Cloud, and GitHub Enterprise
+Server installations:
+
+| Entry point                | Slug                          | Host                                |
+| -------------------------- | ----------------------------- | ----------------------------------- |
+| `github`                   | `github`                      | `github.com`                        |
+| `github-enterprise-cloud`  | `github-enterprise-cloud`     | `<tenant>.ghe.com`                  |
+| `github-enterprise-server` | `github-enterprise-server`    | operator-supplied via the `host` option |
+
+Phase 1 ships the OAuth App flow only; GitHub App installation tokens are
+deferred. The access token returned by the OAuth grant is passed straight
+to GitHub APIs as a `Bearer` token, so `materialize()` is a no-op.
+
+## Manifest options
+
+| Option           | Required  | Description                                                                |
+| ---------------- | --------- | -------------------------------------------------------------------------- |
+| `host`           | GHEC/GHES | Tenant or appliance host (e.g. `tenant.ghe.com`, `github.example.com`).    |
+| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email`).    |
+
+## Credentials
+
+| Field            | Required |
+| ---------------- | -------- |
+| `client_id`      | yes      |
+| `client_secret`  | yes      |
+
+## License
+
+BSD-3-Clause.

imbi_plugin_github-0.1.0/README.md

@@ -0,0 +1,33 @@
+# imbi-plugin-github
+
+GitHub identity plugin for Imbi. Ships three entry points so the admin UI
+can distinguish github.com, GitHub Enterprise Cloud, and GitHub Enterprise
+Server installations:
+
+| Entry point                | Slug                          | Host                                |
+| -------------------------- | ----------------------------- | ----------------------------------- |
+| `github`                   | `github`                      | `github.com`                        |
+| `github-enterprise-cloud`  | `github-enterprise-cloud`     | `<tenant>.ghe.com`                  |
+| `github-enterprise-server` | `github-enterprise-server`    | operator-supplied via the `host` option |
+
+Phase 1 ships the OAuth App flow only; GitHub App installation tokens are
+deferred. The access token returned by the OAuth grant is passed straight
+to GitHub APIs as a `Bearer` token, so `materialize()` is a no-op.
+
+## Manifest options
+
+| Option           | Required  | Description                                                                |
+| ---------------- | --------- | -------------------------------------------------------------------------- |
+| `host`           | GHEC/GHES | Tenant or appliance host (e.g. `tenant.ghe.com`, `github.example.com`).    |
+| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email`).    |
+
+## Credentials
+
+| Field            | Required |
+| ---------------- | -------- |
+| `client_id`      | yes      |
+| `client_secret`  | yes      |
+
+## License
+
+BSD-3-Clause.

imbi_plugin_github-0.1.0/justfile

@@ -0,0 +1,59 @@
+[default]
+[private]
+@help:
+    just --list
+
+[private]
+ci: lint test
+
+[doc("Set up your development environment")]
+[group("Environment")]
+setup:
+    uv sync --all-groups --all-extras --frozen
+    uv run pre-commit install --install-hooks --overwrite
+
+[doc("Run tests")]
+[group("Testing")]
+test *FILES: setup
+    #!/usr/bin/env sh
+    set -e
+    env_args=""
+    if [ -f .env ]; then
+      env_args="--env-file .env"
+    fi
+    if [ -z "{{ FILES }}" ]; then
+      uv run $env_args coverage run -m pytest tests
+      uv run coverage report
+      uv run coverage xml -o build/coverage.xml
+    else
+      uv run $env_args pytest {{ FILES }}
+    fi
+
+[doc("Run linters")]
+[group("Testing")]
+lint: setup
+    uv run pre-commit run --all-files
+
+[doc("Reformat code (optionally pass specific files)")]
+[group("Development")]
+format *FILES: setup
+    #!/usr/bin/env sh
+    if [ "{{ FILES }}" = '' ]; then
+        args='--all-files'
+    else
+        args='--files {{ FILES }}'
+    fi
+    uv run pre-commit run ruff-format $args
+    uv run pre-commit run tombi-format $args
+
+[doc("Remove runtime development artifacts")]
+[group("Environment")]
+clean:
+    rm -f .coverage .env
+    rm -fR build
+
+[confirm]
+[doc("Remove caches, virtual env, and output files")]
+[group("Environment")]
+real-clean: clean
+    rm -fR .venv .*_cache dist

imbi_plugin_github-0.1.0/pyproject.toml

@@ -0,0 +1,124 @@
+[project]
+name = "imbi-plugin-github"
+version = "0.1.0"
+description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
+readme = "README.md"
+requires-python = ">=3.14"
+license = { text = "BSD-3-Clause" }
+authors = [{ name = "Gavin M. Roy", email = "gavinr@aweber.com" }]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Natural Language :: English",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.14",
+]
+dependencies = [
+  "httpx>=0.27",
+  "imbi-common>=0.8.4",
+  "pydantic>=2",
+]
+
+[project.entry-points."imbi.plugins"]
+github = "imbi_plugin_github.identity:GitHubPlugin"
+github-enterprise-cloud = "imbi_plugin_github.identity:GitHubEnterpriseCloudPlugin"
+github-enterprise-server = "imbi_plugin_github.identity:GitHubEnterpriseServerPlugin"
+github-deployment = "imbi_plugin_github.deployment:GitHubDeploymentPlugin"
+github-deployment-ec = "imbi_plugin_github.deployment:GitHubEnterpriseCloudDeploymentPlugin"
+github-deployment-es = "imbi_plugin_github.deployment:GitHubEnterpriseServerDeploymentPlugin"
+
+[dependency-groups]
+dev = [
+  "basedpyright",
+  "coverage[toml]",
+  "imbi-common[server,databases]",
+  "pre-commit",
+  "pytest",
+  "pytest-asyncio",
+  "respx",
+  "ruff~=0.14.6",
+]
+dist = ["build", "twine", "wheel"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/imbi_plugin_github"]
+
+[tool.coverage.report]
+exclude_also = ["typing.TYPE_CHECKING"]
+fail_under = 85
+show_missing = true
+
+[tool.coverage.run]
+branch = true
+source = ["src/imbi_plugin_github"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.pyright]
+executionEnvironments = [
+  { root = "src" },
+  { root = "tests", reportPrivateUsage = false },
+]
+deprecateTypingAliases = true
+reportMissingSuperCall = "hint"
+reportMissingTypeStubs = false
+typeCheckingMode = "strict"
+
+[tool.ruff]
+line-length = 79
+target-version = "py314"
+
+[tool.ruff.format]
+quote-style = "single"
+
+[tool.ruff.lint]
+select = [
+  "BLE",
+  "C4",
+  "C90",
+  "E",
+  "W",
+  "F",
+  "G",
+  "I",
+  "N",
+  "Q",
+  "S",
+  "ASYNC",
+  "B",
+  "DTZ",
+  "FURB",
+  "RUF",
+  "T20",
+  "UP",
+]
+ignore = [
+  "ASYNC109",
+  "N818",
+  "RSE",
+  "S105",
+  "TRY003",
+  "TRY400",
+  "UP047",
+]
+flake8-quotes = { inline-quotes = "single" }
+
+[tool.ruff.lint.mccabe]
+max-complexity = 15
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["S"]
+
+[tool.uv]
+default-groups = ["dev"]
+
+[[tool.uv.index]]
+url = "https://pypi.org/simple"
+default = true

imbi_plugin_github-0.1.0/src/imbi_plugin_github/__init__.py

@@ -0,0 +1,13 @@
+"""Imbi GitHub identity plugin (github.com / GHEC / GHES)."""
+
+from imbi_plugin_github.identity import (
+    GitHubEnterpriseCloudPlugin,
+    GitHubEnterpriseServerPlugin,
+    GitHubPlugin,
+)
+
+__all__ = [
+    'GitHubEnterpriseCloudPlugin',
+    'GitHubEnterpriseServerPlugin',
+    'GitHubPlugin',
+]

imbi_plugin_github-0.1.0/src/imbi_plugin_github/_hosts.py

@@ -0,0 +1,50 @@
+"""Shared host resolution utilities for the GitHub plugins.
+
+Identity (``plugin.py``) and deployment (``deployment.py``) plugins both
+accept a ``host`` option and need to normalise it to a bare hostname
+that URLs can be safely composed against.  This module is the single
+source of truth for that validation.
+"""
+
+from __future__ import annotations
+
+import typing
+import urllib.parse
+
+
+def normalize_host(raw: typing.Any, label: str) -> str:
+    """Validate and normalize a manifest ``host`` value.
+
+    Strips whitespace, accepts an optional scheme, and rejects values
+    with paths / queries / fragments so callers can compose URLs from
+    the result without producing malformed endpoints.
+    """
+    host = str(raw or '').strip()
+    if not host:
+        raise ValueError(f'{label} requires the "host" option')
+    parsed = urllib.parse.urlsplit(
+        host if '://' in host else f'https://{host}'
+    )
+    if (
+        not parsed.hostname
+        or parsed.port is not None
+        or parsed.path not in ('', '/')
+        or parsed.query
+        or parsed.fragment
+    ):
+        raise ValueError(f'{label} got invalid host value: {host!r}')
+    return parsed.hostname
+
+
+def require_ghec_tenant_host(host: str, label: str) -> str:
+    """Refuse anything that isn't a ``*.ghe.com`` tenant host."""
+    if (
+        not host.endswith('.ghe.com')
+        or host == '.ghe.com'
+        or host.startswith('api.')
+    ):
+        raise ValueError(
+            f'{label} requires a tenant host like "tenant.ghe.com"; '
+            f'got {host!r}'
+        )
+    return host