imbi-plugin-github 1.1.0__tar.gz → 1.4.0__tar.gz

imbi_plugin_github-1.4.0/CLAUDE.md

@@ -0,0 +1,128 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What This Is
+
+A set of GitHub plugins for the Imbi platform, distributed as a single
+Python package (`imbi_plugin_github`). It ships **three plugin types**
+(identity, deployment, lifecycle), each in **three host flavors**
+(github.com, GitHub Enterprise Cloud, GitHub Enterprise Server) — nine
+plugins total. The Imbi host discovers them through the
+`imbi.plugins` entry points declared in `pyproject.toml`; that table is
+the registration surface — adding a plugin class means adding an entry
+point there.
+
+All plugin base classes (`IdentityPlugin`, `DeploymentPlugin`,
+`LifecyclePlugin`, `PluginContext`, `PluginManifest`, the result/dataclass
+types) come from `imbi_common.plugins.base`. That module is the contract
+this package implements against; read it (in the sibling `imbi-common`
+repo) before changing a plugin's method signatures.
+
+## Commands
+
+```bash
+just setup              # uv sync --all-groups --all-extras + install pre-commit hooks
+just test               # coverage run -m pytest tests + coverage report/xml (fails under 85%)
+just test tests/test_lifecycle.py                       # one file
+just test tests/test_lifecycle.py::ManifestTestCase     # one class/test (passed straight to pytest)
+just lint               # pre-commit run --all-files (ruff, ruff-format, tombi, basedpyright)
+just format [FILES]     # ruff-format + tombi-format
+```
+
+`just test` with arguments skips the coverage wrapper and runs `pytest`
+directly. `.env`, if present, is passed via `--env-file` (not required
+for the test suite). Type checking is `basedpyright` in **strict** mode
+over `src`. Python is pinned to **3.14**; ruff uses single quotes and a
+79-char line length.
+
+## Architecture
+
+### The base/subclass/host-flavor pattern
+
+Every plugin type follows the same shape: one `_*Base` class holds all
+behavior, and three thin concrete subclasses differ *only* in their
+`_resolve_host(options)` classmethod:
+
+- github.com flavor → returns `'github.com'`.
+- GHEC flavor → reads the required `host` option, validates it's a
+  `*.ghe.com` tenant via `require_ghec_tenant_host`.
+- GHES flavor → reads the required `host` option, normalized only.
+
+`_resolve_host` feeds URL construction, and the three backends route
+differently — this mapping is the single most important thing to keep
+consistent and is **duplicated** across the three modules
+(`identity._endpoints`, `deployment._api_base`, `lifecycle._api_base`):
+
+| Host                | REST API base                  | OAuth base (identity only)        |
+| ------------------- | ------------------------------ | --------------------------------- |
+| `github.com`        | `https://api.github.com`       | `https://github.com/login/oauth`  |
+| `<tenant>.ghe.com`  | `https://api.<tenant>.ghe.com` | `https://<tenant>.ghe.com/login/oauth` |
+| GHES `<host>`       | `https://<host>/api/v3`        | `https://<host>/login/oauth`      |
+
+When you change routing for one plugin type, check whether the other two
+need the same change.
+
+### Shared helpers (single sources of truth)
+
+- `_hosts.py` — `normalize_host` (strip/validate a bare hostname, reject
+  paths/ports/queries) and `require_ghec_tenant_host`. All host-option
+  validation lives here.
+- `_repos.py` — `resolve_owner_repo(ctx, host, label)` derives the target
+  `(owner, repo)` for deployment and lifecycle calls: it scans
+  `ctx.project_links` (preferring the `github-repository` key, skipping
+  reserved GitHub path prefixes like `/orgs/`), then falls back to
+  `<project_type_slug>/<project_slug>`, and raises `ValueError` with an
+  operator-facing message when neither works.
+
+### Plugin invocation contract
+
+Plugins are **stateless and single-shot**: the host constructs the
+plugin once and calls methods passing `PluginContext` plus a
+`credentials` dict per call. Identity plugins mint the OAuth access
+token; deployment and lifecycle plugins consume it via
+`credentials['access_token']` (with a `'token'` fallback) and send it as
+a `Bearer` header. A `401` response is converted to
+`PluginAuthenticationFailed` by an httpx response hook so the host's
+retry layer can refresh the actor's identity once before failing the
+user-visible request.
+
+### Behaviors that span multiple files / aren't obvious from one method
+
+- **Deployment uses the GitHub Deployments API**, not
+  `workflow_dispatch`: Imbi's `Environment` maps 1:1 to GitHub's
+  `environment` so protection rules apply server-side. `trigger_deployment`
+  sends `auto_merge=False` and `required_contexts=[]` deliberately.
+  Promote behavior (semver tag → Deployment vs. raw SHA → tag + Release)
+  is decided **host-side** in imbi-api, not here. Per-environment workflow
+  inputs ride on the `USES_PLUGIN` graph edge as `env_payloads` and arrive
+  as `ctx.environment_config`.
+- **`/check-runs` 403 cache** in `deployment.py`: a process-wide,
+  TTL'd cache (keyed by a hash of token+host+repo) suppresses repeated
+  403s when the token lacks scope or Actions is disabled, so opening a
+  deploy dialog doesn't fire one wasted 403 per commit.
+- **Lifecycle archive-with-transfer dance** (`lifecycle.py`): when
+  `archive_target_org` is set, archive transfers the repo there first.
+  GitHub refuses to transfer an *archived* repo, so an already-archived
+  source is briefly unarchived → transferred → re-archived. GitHub's
+  transfer is **async** (returns 202, repo briefly 404s at the
+  destination), so the post-transfer archive PATCH retries on 404 with a
+  bounded backoff (`_TRANSFER_ARCHIVE_BACKOFFS`). Unarchive only flips
+  `archived` back at the repo's current location — it never transfers
+  back, because the original owner isn't tracked.
+
+## Testing
+
+Tests mock GitHub's HTTP with **respx** (`asyncio_mode = auto`, so async
+tests need no decorator). Each test builds a `PluginContext` with a
+`github-repository` project link and passes `{'access_token': ...}`
+credentials, mirroring how the host calls in. When adding a GitHub API
+call, add the matching respx route. Coverage must stay ≥ 85%.
+
+## Dependency Management
+
+`pyproject.toml` pins the package to PyPI (`pypi.org`) with a 7-day
+`exclude-newer` holdback on third-party packages; the imbi-common and
+`imbi-plugin-*` packages are exempt via `exclude-newer-package` so local
+ecosystem changes aren't held back. After changing dependencies, run
+`uv sync` and verify `uv.lock`.

{imbi_plugin_github-1.1.0 → imbi_plugin_github-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 1.1.0
+Version: 1.4.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common>=0.11.0
+Requires-Dist: imbi-common>=2.5.5
 Requires-Dist: pydantic>=2
 Description-Content-Type: text/markdown
 
@@ -33,15 +33,17 @@ projects to the right backend.
 
 ### Identity
 
-Phase 1 ships the OAuth App flow only; GitHub App installation tokens are
-deferred. The access token returned by the OAuth grant is passed straight
-to GitHub APIs as a `Bearer` token, so `materialize()` is a no-op.
+Implements the OAuth App flow. The access token returned by the OAuth
+grant is passed straight to GitHub APIs as a `Bearer` token, so
+`materialize()` is a no-op.
 
 ### Deployment
 
 Drives the GitHub Deployments API (`POST /repos/{owner}/{repo}/deployments`)
-plus tag and release creation. See `deployment.py` for the per-environment
-`DEPLOYS_VIA` edge contract.
+plus tag and release creation. Promote behaviour is inferred from the
+ref shape by the host (semver → trigger Deployment, raw SHA → cut tag
++ Release).  Per-env workflow inputs ride on the `USES_PLUGIN` edge as
+`env_payloads` and arrive on `PluginContext.environment_config`.
 
 ### Lifecycle
 
@@ -66,7 +68,7 @@ requires admin permission on the target organization.
 | Option           | Required  | Description                                                                |
 | ---------------- | --------- | -------------------------------------------------------------------------- |
 | `host`           | GHEC/GHES | Tenant or appliance host (e.g. `tenant.ghe.com`, `github.example.com`).    |
-| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email`).    |
+| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email repo workflow`). |
 
 ## Credentials (identity)
 

{imbi_plugin_github-1.1.0 → imbi_plugin_github-1.4.0}/README.md

@@ -14,15 +14,17 @@ projects to the right backend.
 
 ### Identity
 
-Phase 1 ships the OAuth App flow only; GitHub App installation tokens are
-deferred. The access token returned by the OAuth grant is passed straight
-to GitHub APIs as a `Bearer` token, so `materialize()` is a no-op.
+Implements the OAuth App flow. The access token returned by the OAuth
+grant is passed straight to GitHub APIs as a `Bearer` token, so
+`materialize()` is a no-op.
 
 ### Deployment
 
 Drives the GitHub Deployments API (`POST /repos/{owner}/{repo}/deployments`)
-plus tag and release creation. See `deployment.py` for the per-environment
-`DEPLOYS_VIA` edge contract.
+plus tag and release creation. Promote behaviour is inferred from the
+ref shape by the host (semver → trigger Deployment, raw SHA → cut tag
++ Release).  Per-env workflow inputs ride on the `USES_PLUGIN` edge as
+`env_payloads` and arrive on `PluginContext.environment_config`.
 
 ### Lifecycle
 
@@ -47,7 +49,7 @@ requires admin permission on the target organization.
 | Option           | Required  | Description                                                                |
 | ---------------- | --------- | -------------------------------------------------------------------------- |
 | `host`           | GHEC/GHES | Tenant or appliance host (e.g. `tenant.ghe.com`, `github.example.com`).    |
-| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email`).    |
+| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email repo workflow`). |
 
 ## Credentials (identity)
 

{imbi_plugin_github-1.1.0 → imbi_plugin_github-1.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "1.1.0"
+version = "1.4.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,7 +16,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common>=0.11.0",
+  "imbi-common>=2.5.5",
   "pydantic>=2",
 ]
 
@@ -48,9 +48,6 @@ dist = ["build", "twine", "wheel"]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
-[tool.hatch.build.targets.wheel]
-packages = ["src/imbi_plugin_github"]
-
 [tool.coverage.report]
 exclude_also = ["typing.TYPE_CHECKING"]
 fail_under = 85
@@ -60,9 +57,8 @@ show_missing = true
 branch = true
 source = ["src/imbi_plugin_github"]
 
-[tool.pytest.ini_options]
-asyncio_mode = "auto"
-asyncio_default_fixture_loop_scope = "function"
+[tool.hatch.build.targets.wheel]
+packages = ["src/imbi_plugin_github"]
 
 [tool.pyright]
 executionEnvironments = [
@@ -74,6 +70,10 @@ reportMissingSuperCall = "hint"
 reportMissingTypeStubs = false
 typeCheckingMode = "strict"
 
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
 [tool.ruff]
 line-length = 79
 target-version = "py314"
@@ -121,6 +121,8 @@ max-complexity = 15
 
 [tool.uv]
 default-groups = ["dev"]
+exclude-newer = "7 days"
+exclude-newer-package = { "clickhouse-connect" = false, "imbi-common" = false, "imbi-plugin-aws" = false, "imbi-plugin-github" = false, "imbi-plugin-logzio" = false, "imbi-plugin-oidc" = false, "imbi-plugin-pagerduty" = false, "imbi-plugin-sentry" = false, "imbi-plugin-sonarqube" = false }
 
 [[tool.uv.index]]
 url = "https://pypi.org/simple"

{imbi_plugin_github-1.1.0 → imbi_plugin_github-1.4.0}/src/imbi_plugin_github/deployment.py

@@ -38,8 +38,10 @@ from imbi_common.plugins.base import (
     Commit,
     CompareResult,
     CredentialField,
+    DeploymentEventStatus,
     DeploymentPlugin,
     DeploymentRun,
+    OpsLogTemplate,
     PluginContext,
     PluginEdgeLabel,
     PluginManifest,
@@ -47,6 +49,7 @@ from imbi_common.plugins.base import (
     Ref,
     RefInfo,
     ReleaseInfo,
+    RemoteDeployment,
     WorkflowFile,
 )
 from imbi_common.plugins.errors import PluginAuthenticationFailed
@@ -577,7 +580,7 @@ class _DeploymentBase(DeploymentPlugin):
                 deletions=deletions,
             )
 
-    # -- Tags / Releases (Phase 2 — implemented here for completeness) -----
+    # -- Tags / Releases ----------------------------------------------------
 
     async def create_tag(
         self,
@@ -669,8 +672,9 @@ class _DeploymentBase(DeploymentPlugin):
         promote refs are often freshly-cut tags whose CI hasn't run yet,
         and the deploy workflow itself is what we're waiting on.
 
-        Payload precedence (highest wins): per-env edge ``payload`` from
-        ``ctx.environment_config['payload']`` over ``inputs`` from the
+        Payload precedence (lowest → highest): plugin assignment
+        ``env_payloads[env_slug]`` (carried by the host on
+        ``ctx.environment_config``) below the ``inputs`` map from the
         caller.  The ``ref`` and ``environment`` are not part of the
         payload — they're top-level fields on the deployment object.
         """
@@ -678,12 +682,9 @@ class _DeploymentBase(DeploymentPlugin):
             raise ValueError(
                 'trigger_deployment requires PluginContext.environment'
             )
-        merged_payload: dict[str, typing.Any] = dict(inputs or {})
-        env_payload = ctx.environment_config.get('payload')
-        if isinstance(env_payload, dict):
-            merged_payload.update(
-                typing.cast(dict[str, typing.Any], env_payload)
-            )
+        merged_payload: dict[str, typing.Any] = dict(ctx.environment_config)
+        if inputs:
+            merged_payload.update(inputs)
         async with self._client(ctx, credentials) as client:
             resp = await client.post(
                 '/deployments',
@@ -717,7 +718,7 @@ class _DeploymentBase(DeploymentPlugin):
         """List ``.github/workflows/*.yml`` registered for the repo.
 
         Used by the UI to populate a workflow dropdown when an operator
-        wires up the per-environment ``DEPLOYS_VIA`` edge.  Returns only
+        configures plugin assignment ``env_payloads``.  Returns only
         ``active`` workflows by default; callers that need disabled
         entries can filter the result themselves.  GitHub caps the
         ``/actions/workflows`` page at 100 — that's more than enough for
@@ -839,37 +840,186 @@ class _DeploymentBase(DeploymentPlugin):
                 else None,
             )
 
+    async def list_recent_deployments(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        environments: list[str],
+        limit: int = 1,
+    ) -> list[RemoteDeployment]:
+        """Return the latest ``limit`` deployments per environment.
+
+        Fans out one ``GET /deployments?environment={env}`` call per
+        requested environment in parallel, then for each returned
+        deployment fetches the latest status via ``GET
+        /deployments/{id}/statuses?per_page=1``.  Environments the
+        remote does not recognise are silently skipped so a partial
+        resync still returns the deployments that do exist (an env
+        the repo simply hasn't deployed to yet is the common case).
+
+        The host calls this from the resync flow only when webhook
+        delivery has lapsed, so we keep the fan-out modest (``limit=1``
+        is the host's default) and let the host walk further history
+        with explicit pagination if it ever needs to.
+        """
+        page_size = max(1, min(limit, 100))
+        async with self._client(ctx, credentials) as client:
+            per_env = await asyncio.gather(
+                *(
+                    self._list_deployments_for_env(client, env, page_size)
+                    for env in environments
+                )
+            )
+        return [observed for group in per_env for observed in group]
+
+    async def _list_deployments_for_env(
+        self,
+        client: httpx.AsyncClient,
+        environment: str,
+        page_size: int,
+    ) -> list[RemoteDeployment]:
+        try:
+            resp = await client.get(
+                '/deployments',
+                params={
+                    'environment': environment,
+                    'per_page': str(page_size),
+                },
+            )
+            if resp.status_code == 404:
+                # Repo or environment unknown on the remote — treat as
+                # "nothing to backfill" rather than failing the resync.
+                return []
+            resp.raise_for_status()
+        except httpx.HTTPError:
+            LOGGER.warning(
+                'Failed to list deployments for env=%s',
+                environment,
+                exc_info=True,
+            )
+            return []
+        try:
+            deployments = typing.cast(list[dict[str, typing.Any]], resp.json())
+        except ValueError:
+            LOGGER.warning(
+                'Failed to parse deployments payload for env=%s',
+                environment,
+            )
+            return []
+        observed: list[RemoteDeployment] = []
+        for deployment in deployments:
+            run = await self._observe_deployment(
+                client, environment, deployment
+            )
+            if run is not None:
+                observed.append(run)
+        return observed
+
+    async def _observe_deployment(
+        self,
+        client: httpx.AsyncClient,
+        environment: str,
+        deployment: dict[str, typing.Any],
+    ) -> RemoteDeployment | None:
+        deployment_id = deployment.get('id')
+        sha = deployment.get('sha')
+        if not deployment_id or not sha:
+            # GitHub always returns both, but defend the resync path
+            # against a malformed response — we'd rather skip one row
+            # than corrupt the graph by inventing identifiers.
+            return None
+        created_at = _parse_iso(deployment.get('created_at')) or (
+            datetime.datetime.now(datetime.UTC)
+        )
+        status, status_url = await self._latest_status(
+            client, str(deployment_id)
+        )
+        ref_value = deployment.get('ref')
+        description = deployment.get('description')
+        deployment_url = deployment.get('url') or deployment.get('html_url')
+        creator_login: str | None = None
+        creator_raw = deployment.get('creator')
+        if isinstance(creator_raw, dict):
+            creator_dict = typing.cast(dict[str, typing.Any], creator_raw)
+            login = creator_dict.get('login')
+            if isinstance(login, str) and login:
+                creator_login = login
+        return RemoteDeployment(
+            environment=environment,
+            sha=str(sha),
+            ref=str(ref_value) if ref_value else None,
+            status=status,
+            created_at=created_at,
+            external_run_id=str(deployment_id),
+            run_url=status_url,
+            deployment_url=str(deployment_url) if deployment_url else None,
+            description=str(description) if description else None,
+            creator=creator_login,
+        )
+
+    async def _latest_status(
+        self, client: httpx.AsyncClient, deployment_id: str
+    ) -> tuple[DeploymentEventStatus, str | None]:
+        """Return the canonical event status + workflow log URL.
+
+        Falls back to ``'pending'`` whenever the deploy workflow has
+        not yet posted a status: a freshly-created deployment with no
+        statuses is structurally identical to one whose workflow has
+        not started, and ``pending`` is the host's vocabulary for
+        both.  Network / parse errors degrade the same way so resync
+        is never blocked by a single noisy row.
+        """
+        try:
+            resp = await client.get(
+                f'/deployments/{deployment_id}/statuses',
+                params={'per_page': '1'},
+            )
+        except httpx.HTTPError:
+            return 'pending', None
+        if resp.status_code != 200:
+            return 'pending', None
+        try:
+            statuses = typing.cast(list[dict[str, typing.Any]], resp.json())
+        except ValueError:
+            return 'pending', None
+        if not statuses:
+            return 'pending', None
+        latest = statuses[0]
+        state = str(latest.get('state') or '').lower()
+        log_url = latest.get('log_url') or latest.get('target_url')
+        return _to_event_status(state), str(log_url) if log_url else None
+
+
+def _to_event_status(github_state: str) -> DeploymentEventStatus:
+    """Map a GitHub deployment-status ``state`` to the host vocabulary.
+
+    Unknown states fold to ``pending`` rather than raising so a single
+    novel value on the remote does not break resync for the whole
+    project.  ``inactive`` on GitHub means a newer deployment for the
+    same environment superseded this one, which the host models as
+    ``rolled_back`` on the ``DeploymentEvent``.
+    """
+    if github_state in {'pending', 'queued', 'waiting'}:
+        return 'pending'
+    if github_state == 'in_progress':
+        return 'in_progress'
+    if github_state == 'success':
+        return 'success'
+    if github_state in {'failure', 'error'}:
+        return 'failed'
+    if github_state == 'inactive':
+        return 'rolled_back'
+    return 'pending'
+
 
 _COMMON_OPTIONS: list[PluginOption] = []
 
-_COMMON_EDGE_LABELS: list[PluginEdgeLabel] = [
-    PluginEdgeLabel(
-        name='DEPLOYS_VIA',
-        # The edge can hang off the ProjectType (the usual case — every
-        # python-api project deploys to staging via release, etc.) or a
-        # specific Project (rare override slot).
-        from_labels=['ProjectType', 'Project'],
-        to_labels=['Environment'],
-        properties={
-            # 'release'    -> create_tag + create_release; no deployment
-            #                 (the repo's ``on: release: [published]``
-            #                 trigger handles it).
-            # 'deployment' -> POST /deployments only (no tag/release).
-            'action': 'str',
-            # Free-form key/value pairs forwarded as the GitHub
-            # deployment ``payload``.  The deploy workflow reads them
-            # via ``github.event.deployment.payload`` -- so this is
-            # where operators stash things like a target cluster name,
-            # a feature flag bundle, etc.  Empty by default.
-            'payload': 'dict[str, str]',
-            # Per-environment identity override.  Lets ``production``
-            # post the deployment as a different OAuth identity than
-            # ``staging`` -- handy when prod requires a service
-            # account with extra deploy scopes.
-            'identity_plugin_id': 'str',
-        },
-    ),
-]
+# Promote behaviour is now inferred from the ``body.tag`` shape on the
+# imbi-api side: semver tags trigger a Deployment, raw SHAs cut a tag
+# + GitHub Release.  Per-env workflow input overrides live on the
+# ``USES_PLUGIN`` edge under ``env_payloads`` (keyed by env slug),
+# resolved by the host and passed in via ``ctx.environment_config``.
+_COMMON_EDGE_LABELS: list[PluginEdgeLabel] = []
 
 _COMMON_CREDENTIALS: list[CredentialField] = [
     CredentialField(
@@ -884,6 +1034,33 @@ _COMMON_CREDENTIALS: list[CredentialField] = [
 ]
 
 
+# Templates for the operations-log JSON payload the API writes from
+# ``_record_deployment_event`` in imbi-api: ``{action, plugin_slug,
+# run_url, release_url, from_environment}``.  Row-level fields
+# ``version`` and ``environment`` (from the entry's
+# ``environment_slug``/``environment.name``) are also in scope.
+_COMMON_OPS_LOG_TEMPLATES: dict[str, OpsLogTemplate] = {
+    'deploy': OpsLogTemplate(
+        label='Deployed {{version}} to {{environment}}',
+        summary='deployed',
+    ),
+    'redeploy': OpsLogTemplate(
+        label='Re-deployed {{version}} to {{environment}}',
+        summary='re-deployed',
+    ),
+    'promote': OpsLogTemplate(
+        label=(
+            'Promoted {{from_environment}} to {{environment}} as {{version}}.'
+        ),
+        summary='promoted',
+    ),
+    'resync': OpsLogTemplate(
+        label='Recorded {{version}} deploy in {{environment}}',
+        summary='recorded a deploy in',
+    ),
+}
+
+
 class GitHubDeploymentPlugin(_DeploymentBase):
     manifest = PluginManifest(
         slug='github-deployment',
@@ -896,9 +1073,11 @@ class GitHubDeploymentPlugin(_DeploymentBase):
             'server-side.'
         ),
         plugin_type='deployment',
+        supports_deployment_sync=True,
         options=_COMMON_OPTIONS,
         credentials=_COMMON_CREDENTIALS,
         edge_labels=_COMMON_EDGE_LABELS,
+        ops_log_templates=_COMMON_OPS_LOG_TEMPLATES,
     )
 
     @classmethod
@@ -916,6 +1095,7 @@ class GitHubEnterpriseCloudDeploymentPlugin(_DeploymentBase):
             '``on: deployment_status``) in their deploy workflow.'
         ),
         plugin_type='deployment',
+        supports_deployment_sync=True,
         options=[
             PluginOption(
                 name='host',
@@ -928,6 +1108,7 @@ class GitHubEnterpriseCloudDeploymentPlugin(_DeploymentBase):
         ],
         credentials=_COMMON_CREDENTIALS,
         edge_labels=_COMMON_EDGE_LABELS,
+        ops_log_templates=_COMMON_OPS_LOG_TEMPLATES,
     )
 
     @classmethod
@@ -948,6 +1129,7 @@ class GitHubEnterpriseServerDeploymentPlugin(_DeploymentBase):
             'in their deploy workflow.'
         ),
         plugin_type='deployment',
+        supports_deployment_sync=True,
         options=[
             PluginOption(
                 name='host',
@@ -959,6 +1141,7 @@ class GitHubEnterpriseServerDeploymentPlugin(_DeploymentBase):
         ],
         credentials=_COMMON_CREDENTIALS,
         edge_labels=_COMMON_EDGE_LABELS,
+        ops_log_templates=_COMMON_OPS_LOG_TEMPLATES,
     )
 
     @classmethod

{imbi_plugin_github-1.1.0 → imbi_plugin_github-1.4.0}/src/imbi_plugin_github/identity.py

@@ -7,9 +7,8 @@ Three concrete subclasses share one base and differ only by host:
 * :class:`GitHubEnterpriseServerPlugin` — operator-managed GHES; the
   hostname comes from a manifest option.
 
-Phase 1 implements the OAuth App flow only.  GitHub App installation
-tokens (org-scoped automation) are deferred — service principals
-continue to use the legacy ``ServiceApplication`` model.
+The plugins implement the OAuth App flow: the access token from the
+OAuth grant is passed straight to GitHub APIs as a ``Bearer`` token.
 """
 
 from __future__ import annotations