imbi-plugin-github 2.10.0__tar.gz → 2.11.0__tar.gz

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.10.0
+Version: 2.11.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.10.0
+Requires-Dist: imbi-common[databases]==2.11.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.10.0"
+version = "2.11.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,7 +16,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.10.0",
+  "imbi-common[databases]==2.11.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]
@@ -37,7 +37,7 @@ github-commit-sync = "imbi_plugin_github.commits:GitHubCommitSyncPlugin"
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.10.0",
+  "imbi-common[server,databases]==2.11.0",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/src/imbi_plugin_github/commits.py

@@ -50,12 +50,14 @@ from imbi_common.json_pointer import JsonPointer
 from imbi_common.models import CommitRecord, TagRecord
 from imbi_common.plugins.base import (
     ActionDescriptor,
+    CheckStatus,
     CredentialField,
     PluginContext,
     PluginManifest,
     ServicePlugin,
     WebhookActionPlugin,
 )
+from imbi_common.plugins.errors import PluginRateLimited
 
 from imbi_plugin_github import _app_auth
 from imbi_plugin_github._hosts import (
@@ -66,10 +68,13 @@ from imbi_plugin_github._hosts import (
 from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
+    _check_runs_to_status,  # pyright: ignore[reportPrivateUsage]
+    _checks_disabled,  # pyright: ignore[reportPrivateUsage]
     _next_page_url,  # pyright: ignore[reportPrivateUsage]
     _parse_iso,  # pyright: ignore[reportPrivateUsage]
     _query_param,  # pyright: ignore[reportPrivateUsage]
     _raise_on_401,  # pyright: ignore[reportPrivateUsage]
+    _record_checks_disabled,  # pyright: ignore[reportPrivateUsage]
     _short_sha,  # pyright: ignore[reportPrivateUsage]
 )
 
@@ -91,6 +96,11 @@ _MAX_COMPARE_PAGES = 20
 # backfill so a very deep repo can't pin the worker indefinitely; the
 # walk logs a truncation warning when it hits the cap.
 _MAX_HISTORY_PAGES = 100
+# CI status is hydrated with one ``/check-runs`` call per commit, which is
+# prohibitively expensive across a full-history backfill.  Bound it to the
+# most-recent commits (the only ones whose CI is still meaningful and
+# unexpired); older commits keep the ``'unknown'`` default.
+_BACKFILL_CI_LIMIT = 25
 
 # Per-context ceilings on how long a *single* rate-limit pause may block
 # before the sync gives up best-effort (logged).  The webhook actions
@@ -140,6 +150,12 @@ def _throttle_wait(response: httpx.Response) -> float | None:
     * a 403/429 that exhausted the quota but gives no reset -> the
       conservative ``_SECONDARY_LIMIT_WAIT_SECONDS`` floor.
 
+    GHES/GHEC sometimes return a secondary (abuse) limit as a 403/429 with
+    *none* of the standard headers -- only the documented body message
+    ("You have exceeded a secondary rate limit ..."); that phrase is
+    matched as a last resort so such a response pauses on the floor rather
+    than being mistaken for a hard failure.
+
     Returns ``None`` for anything that is *not* a throttle signal --
     including a non-rate-limit 403 (e.g. insufficient scope), which must
     fall through to the caller's normal error handling rather than be
@@ -159,9 +175,27 @@ def _throttle_wait(response: httpx.Response) -> float | None:
             return max(0.0, reset - time.time()) + _RESET_BUFFER_SECONDS
         if response.status_code in (403, 429):
             return _SECONDARY_LIMIT_WAIT_SECONDS
+    if response.status_code in (403, 429) and _is_secondary_limit_body(
+        response
+    ):
+        return _SECONDARY_LIMIT_WAIT_SECONDS
     return None
 
 
+def _is_secondary_limit_body(response: httpx.Response) -> bool:
+    """True if a 403/429 body carries GitHub's secondary-limit message.
+
+    Matched conservatively on the documented phrase so a genuine
+    permission 403 (which the caller must surface) is never mistaken for
+    a throttle.
+    """
+    try:
+        body = response.text
+    except (UnicodeDecodeError, httpx.ResponseNotRead):
+        return False
+    return 'secondary rate limit' in body.lower()
+
+
 async def _request(
     client: httpx.AsyncClient,
     method: str,
@@ -176,11 +210,13 @@ async def _request(
     for the interval GitHub states in its headers, then retries -- up to
     ``_MAX_THROTTLE_RETRIES`` times and never longer than *max_wait* on a
     single pause.  When the stated wait exceeds *max_wait* (or the retries
-    are exhausted) the throttled response is handed back unchanged so the
-    caller's ``raise_for_status`` surfaces it and the sync bails
-    best-effort.  After a *successful* response that exhausted the
-    remaining quota, pauses pre-emptively (subject to the same cap) so the
-    next call doesn't spend a round-trip on a guaranteed rejection.
+    are exhausted) :class:`PluginRateLimited` is raised carrying the epoch
+    at which GitHub will resume, so the host can pause the work and keep it
+    queued rather than fail it; on the webhook path the caller swallows it
+    (a later push re-syncs the gap).  After a *successful* response that
+    exhausted the remaining quota, pauses pre-emptively (subject to the
+    same cap) so the next call doesn't spend a round-trip on a guaranteed
+    rejection.
     """
     attempts = 0
     while True:
@@ -204,13 +240,19 @@ async def _request(
         if wait > max_wait or attempts >= _MAX_THROTTLE_RETRIES:
             LOGGER.warning(
                 'github-commit-sync rate-limited on %s (wait %.0fs, cap '
-                '%.0fs, attempt %d); bailing best-effort',
+                '%.0fs, attempt %d); pausing job until GitHub resumes',
                 url,
                 wait,
                 max_wait,
                 attempts + 1,
             )
-            return response
+            raise PluginRateLimited(
+                retry_at=time.time() + wait,
+                message=(
+                    f'github-commit-sync rate-limited on {url}; '
+                    f'resume in {wait:.0f}s'
+                ),
+            )
         attempts += 1
         LOGGER.warning(
             'github-commit-sync rate-limited on %s; pausing %.0fs then '
@@ -493,6 +535,7 @@ def _commit_record(
     ref: str,
     pushed_at: datetime.datetime,
     author_user: str = '',
+    ci_status: CheckStatus = 'unknown',
 ) -> CommitRecord:
     """Map a GitHub commit object onto a :class:`CommitRecord`.
 
@@ -500,7 +543,8 @@ def _commit_record(
     email + linked login + committer), which the UI-facing
     ``Commit``/``_commit_from_payload`` mapping drops, so it maps the raw
     item directly while reusing the low-level ``_short_sha`` / ``_parse_iso``
-    helpers.
+    helpers.  ``ci_status`` is supplied by the caller (hydrated from
+    ``/check-runs``); it defaults to ``'unknown'`` when not resolved.
     """
     sha = str(item.get('sha') or '')
     commit_meta: dict[str, typing.Any] = item.get('commit') or {}
@@ -519,6 +563,7 @@ def _commit_record(
         author_login=str(gh_author.get('login') or ''),
         author_user=author_user,
         committer_name=str(committer_meta.get('name') or ''),
+        ci_status=ci_status,
         authored_at=authored_at or pushed_at,
         committed_at=_parse_iso(committer_meta.get('date')),
         url=str(item.get('html_url') or ''),
@@ -598,6 +643,92 @@ async def _fetch_recent_commits(
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
 
 
+async def _ci_status(
+    client: httpx.AsyncClient,
+    sha: str,
+    *,
+    credentials: dict[str, str],
+    base: str,
+    owner: str,
+    repo: str,
+    max_wait: float,
+) -> CheckStatus:
+    """Roll up ``/commits/{sha}/check-runs`` into a ci_status string.
+
+    Reuses the deployment plugin's ``/check-runs`` mapping and its 403
+    "checks disabled" cache so a token without the scope spends one 403
+    rather than one per commit.  Degrades to ``'unknown'`` on a 403, any
+    non-200, a parse error, a network error, or a rate-limit pause -- CI
+    status is best-effort metadata and must never fail the sync, mirroring
+    the swallow-and-continue contract the rest of this module follows.
+    """
+    if _checks_disabled(credentials, base, owner, repo):
+        return 'unknown'
+    try:
+        resp = await _request(
+            client, 'GET', f'/commits/{sha}/check-runs', max_wait=max_wait
+        )
+        if resp.status_code == 403:
+            _record_checks_disabled(credentials, base, owner, repo)
+            return 'unknown'
+        if resp.status_code != 200:
+            return 'unknown'
+        payload = typing.cast('dict[str, typing.Any]', resp.json())
+    except Exception:  # noqa: BLE001 - CI status is best-effort metadata
+        return 'unknown'
+    return _check_runs_to_status(payload)
+
+
+async def _hydrate_ci(
+    client: httpx.AsyncClient,
+    shas: list[str],
+    *,
+    credentials: dict[str, str],
+    base: str,
+    owner: str,
+    repo: str,
+    max_wait: float,
+) -> dict[str, CheckStatus]:
+    """Resolve ``ci_status`` for ``shas`` -> ``{sha: status}``.
+
+    Probes the head commit first so a 403 (missing scope / Actions
+    disabled) populates the cache and short-circuits the rest, mirroring
+    the deployment plugin's commit picker.  Shas absent from the returned
+    map fall back to ``'unknown'`` at the call site.
+    """
+    out: dict[str, CheckStatus] = {}
+    if not shas or _checks_disabled(credentials, base, owner, repo):
+        return out
+    head, *tail = shas
+    out[head] = await _ci_status(
+        client,
+        head,
+        credentials=credentials,
+        base=base,
+        owner=owner,
+        repo=repo,
+        max_wait=max_wait,
+    )
+    if not tail or _checks_disabled(credentials, base, owner, repo):
+        return out
+    results = await asyncio.gather(
+        *(
+            _ci_status(
+                client,
+                sha,
+                credentials=credentials,
+                base=base,
+                owner=owner,
+                repo=repo,
+                max_wait=max_wait,
+            )
+            for sha in tail
+        )
+    )
+    out.update(dict(zip(tail, results, strict=True)))
+    return out
+
+
 def _resolve_host_for_context(ctx: PluginContext) -> str | None:
     """Resolve the GitHub web host for an on-demand sync (no payload).
 
@@ -772,24 +903,43 @@ async def sync_commits(
     before = _resolve(action_config.before_selector, event)
     pushed_at = datetime.datetime.now(datetime.UTC)
     token = await _resolve_bearer(credentials, base, owner, repo)
-    async with _client(base, owner, repo, token) as client:
-        if isinstance(before, str) and before and before != _ZERO_SHA:
-            raw = await _fetch_compare_commits(
-                client, before, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
-            )
-        else:
-            last = await _last_known_sha(ctx.project_id)
-            if last:
+    ci_by_sha: dict[str, CheckStatus] = {}
+    try:
+        async with _client(base, owner, repo, token) as client:
+            if isinstance(before, str) and before and before != _ZERO_SHA:
                 raw = await _fetch_compare_commits(
-                    client, last, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                    client, before, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
                 )
             else:
-                raw = await _fetch_recent_commits(
-                    client,
-                    after,
-                    action_config.initial_limit,
-                    max_wait=_WEBHOOK_MAX_WAIT_SECONDS,
-                )
+                last = await _last_known_sha(ctx.project_id)
+                if last:
+                    raw = await _fetch_compare_commits(
+                        client, last, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                    )
+                else:
+                    raw = await _fetch_recent_commits(
+                        client,
+                        after,
+                        action_config.initial_limit,
+                        max_wait=_WEBHOOK_MAX_WAIT_SECONDS,
+                    )
+            ci_by_sha = await _hydrate_ci(
+                client,
+                [str(i['sha']) for i in raw if i.get('sha')],
+                credentials=credentials,
+                base=base,
+                owner=owner,
+                repo=repo,
+                max_wait=_WEBHOOK_MAX_WAIT_SECONDS,
+            )
+    except PluginRateLimited as exc:
+        LOGGER.warning(
+            'github-commit-sync: rate-limited syncing commits for project '
+            '%s; skipping this push (a later push re-syncs the gap): %s',
+            ctx.project_id,
+            exc,
+        )
+        return
     user_map = await _resolve_author_users(
         raw, ctx.resolve_user_by_identity, base
     )
@@ -800,6 +950,7 @@ async def sync_commits(
             ref=ref,
             pushed_at=pushed_at,
             author_user=_author_user(item, user_map),
+            ci_status=ci_by_sha.get(str(item['sha']), 'unknown'),
         )
         for item in raw
         if item.get('sha')
@@ -826,6 +977,73 @@ async def _annotated_tag(
     return typing.cast('dict[str, typing.Any]', resp.json())
 
 
+async def _commit_date(
+    client: httpx.AsyncClient, sha: str, *, max_wait: float
+) -> datetime.datetime | None:
+    """Committer date of commit *sha*, ``None`` when unavailable.
+
+    Lightweight tags carry no tagger date, so their target commit's
+    date stands in for ``tagged_at`` — otherwise the ClickHouse row
+    falls back to ``recorded_at`` (sync time) and every release in the
+    UI reads "just now" after a full reconcile.
+    """
+    resp = await _request(
+        client, 'GET', f'/git/commits/{sha}', max_wait=max_wait
+    )
+    if resp.status_code != 200:
+        return None
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    committer: dict[str, typing.Any] = data.get('committer') or {}
+    return _parse_iso(committer.get('date'))
+
+
+async def _release_published_for_tag(
+    client: httpx.AsyncClient, name: str, *, max_wait: float
+) -> datetime.datetime | None:
+    """Published date of the GitHub release for tag *name*, if any."""
+    resp = await _request(
+        client,
+        'GET',
+        f'/releases/tags/{urllib.parse.quote(name, safe="")}',
+        max_wait=max_wait,
+    )
+    if resp.status_code != 200:
+        return None
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    return _parse_iso(data.get('published_at'))
+
+
+async def _release_published_map(
+    client: httpx.AsyncClient, *, max_wait: float
+) -> dict[str, datetime.datetime]:
+    """Map tag name -> GitHub release published date for the repo.
+
+    One paginated ``/releases`` sweep instead of a per-tag lookup;
+    drafts (``published_at`` null) are skipped.
+    """
+    out: dict[str, datetime.datetime] = {}
+    params: dict[str, str] = {'per_page': '100'}
+    while True:
+        resp = await _request(
+            client, 'GET', '/releases', params=params, max_wait=max_wait
+        )
+        if resp.status_code != 200:
+            return out
+        rows = typing.cast('list[dict[str, typing.Any]]', resp.json())
+        for row in rows:
+            tag = row.get('tag_name')
+            published = _parse_iso(row.get('published_at'))
+            if tag and published:
+                out[str(tag)] = published
+        next_url = _next_page_url(resp.headers.get('link'))
+        if next_url is None:
+            return out
+        next_page = _query_param(next_url, 'page')
+        if next_page is None:
+            return out
+        params['page'] = next_page
+
+
 def _web_base(api_base: str) -> str:
     """Map a REST API base to the web host (inverse of the routing table).
 
@@ -857,9 +1075,24 @@ def _tag_record(
     sha: str,
     annotated: dict[str, typing.Any] | None = None,
     url: str = '',
+    published_at: datetime.datetime | None = None,
+    fallback_tagged_at: datetime.datetime | None = None,
 ) -> TagRecord:
+    """Build the ClickHouse row for one tag.
+
+    ``tagged_at`` preference: the GitHub release's published date
+    (*published_at*), then the annotated tag's tagger date, then the
+    target commit's committer date (*fallback_tagged_at*, lightweight
+    tags only).
+    """
     if annotated is None:
-        return TagRecord(project_id=project_id, name=name, sha=sha, url=url)
+        return TagRecord(
+            project_id=project_id,
+            name=name,
+            sha=sha,
+            url=url,
+            tagged_at=published_at or fallback_tagged_at,
+        )
     tagger: dict[str, typing.Any] = annotated.get('tagger') or {}
     return TagRecord(
         project_id=project_id,
@@ -869,7 +1102,7 @@ def _tag_record(
         message=str(annotated.get('message') or ''),
         tagger_name=str(tagger.get('name') or ''),
         tagger_email=str(tagger.get('email') or ''),
-        tagged_at=_parse_iso(tagger.get('date')),
+        tagged_at=published_at or _parse_iso(tagger.get('date')),
     )
 
 
@@ -886,6 +1119,8 @@ async def _reconcile_tags(
     out: list[TagRecord] = []
     prefix = 'refs/tags/'
     params: dict[str, str] = {'per_page': '100'}
+    # Lazily fetched on the first tag so tag-less repos cost nothing.
+    released: dict[str, datetime.datetime] | None = None
     while True:
         resp = await _request(
             client,
@@ -903,6 +1138,11 @@ async def _reconcile_tags(
             if not ref.startswith(prefix) or not sha:
                 continue
             name = ref[len(prefix) :]
+            if released is None:
+                released = await _release_published_map(
+                    client, max_wait=max_wait
+                )
+            published = released.get(name)
             annotated = (
                 await _annotated_tag(client, sha, max_wait=max_wait)
                 if obj.get('type') == 'tag'
@@ -915,6 +1155,12 @@ async def _reconcile_tags(
                     sha=sha,
                     annotated=annotated,
                     url=_tag_web_url(client, name),
+                    published_at=published,
+                    fallback_tagged_at=(
+                        await _commit_date(client, sha, max_wait=max_wait)
+                        if annotated is None and published is None
+                        else None
+                    ),
                 )
             )
         next_url = _next_page_url(resp.headers.get('link'))
@@ -954,25 +1200,45 @@ async def sync_tags(
         return
     owner, repo, base = resolved
     token = await _resolve_bearer(credentials, base, owner, repo)
-    async with _client(base, owner, repo, token) as client:
-        annotated = await _annotated_tag(
-            client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
-        )
-        records: list[pydantic.BaseModel] = [
-            _tag_record(
-                project_id=ctx.project_id,
-                name=name,
-                sha=after,
-                annotated=annotated,
-                url=_tag_web_url(client, name),
+    try:
+        async with _client(base, owner, repo, token) as client:
+            annotated = await _annotated_tag(
+                client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
             )
-        ]
-        if action_config.reconcile_all:
-            extra = await _reconcile_tags(
-                client, ctx.project_id, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+            published = await _release_published_for_tag(
+                client, name, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
             )
-            seen = {name}
-            records.extend(r for r in extra if r.name not in seen)
+            records: list[pydantic.BaseModel] = [
+                _tag_record(
+                    project_id=ctx.project_id,
+                    name=name,
+                    sha=after,
+                    annotated=annotated,
+                    url=_tag_web_url(client, name),
+                    published_at=published,
+                    fallback_tagged_at=(
+                        await _commit_date(
+                            client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                        )
+                        if annotated is None and published is None
+                        else None
+                    ),
+                )
+            ]
+            if action_config.reconcile_all:
+                extra = await _reconcile_tags(
+                    client, ctx.project_id, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                )
+                seen = {name}
+                records.extend(r for r in extra if r.name not in seen)
+    except PluginRateLimited as exc:
+        LOGGER.warning(
+            'github-commit-sync: rate-limited syncing tags for project '
+            '%s; skipping this push (a later push re-syncs the gap): %s',
+            ctx.project_id,
+            exc,
+        )
+        return
     try:
         await clickhouse.insert('tags', records)
     except Exception:
@@ -1102,7 +1368,10 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         Returns ``(commits_recorded, tags_recorded)``.  Raises
         :class:`ValueError` only when the host or repository can't be
         resolved; ClickHouse failures are swallowed (the count reflects
-        what was written).
+        what was written).  Propagates :class:`PluginRateLimited` when a
+        GitHub rate-limit reset is further out than
+        ``_BACKFILL_MAX_WAIT_SECONDS`` so the host can pause the worker and
+        keep the job queued until GitHub resumes rather than fail it.
         """
         host = _resolve_host_for_context(ctx)
         if host is None:
@@ -1124,6 +1393,22 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
             tags = await _reconcile_tags(
                 client, ctx.project_id, max_wait=_BACKFILL_MAX_WAIT_SECONDS
             )
+            # CI status only for the most-recent commits: one /check-runs
+            # call per commit is too costly across full history, and old
+            # commits' CI is no longer meaningful.
+            ci_by_sha = await _hydrate_ci(
+                client,
+                [
+                    str(i['sha'])
+                    for i in raw_commits[:_BACKFILL_CI_LIMIT]
+                    if i.get('sha')
+                ],
+                credentials=credentials,
+                base=base,
+                owner=owner,
+                repo=repo,
+                max_wait=_BACKFILL_MAX_WAIT_SECONDS,
+            )
         user_map = await _resolve_author_users(
             raw_commits, ctx.resolve_user_by_identity, base
         )
@@ -1134,6 +1419,7 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
                 ref=branch,
                 pushed_at=pushed_at,
                 author_user=_author_user(item, user_map),
+                ci_status=ci_by_sha.get(str(item['sha']), 'unknown'),
             )
             for item in raw_commits
             if item.get('sha')

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/src/imbi_plugin_github/deployment.py

@@ -1035,12 +1035,18 @@ class _DeploymentBase(DeploymentPlugin):
         description = deployment.get('description')
         deployment_url = deployment.get('url') or deployment.get('html_url')
         creator_login: str | None = None
+        creator_subject: str | None = None
         creator_raw = deployment.get('creator')
         if isinstance(creator_raw, dict):
             creator_dict = typing.cast(dict[str, typing.Any], creator_raw)
             login = creator_dict.get('login')
             if isinstance(login, str) and login:
                 creator_login = login
+            # GitHub's numeric user id is the stable identity subject the
+            # host resolves to an Imbi user (logins can be renamed).
+            creator_id = creator_dict.get('id')
+            if isinstance(creator_id, int):
+                creator_subject = str(creator_id)
         return RemoteDeployment(
             environment=environment,
             sha=str(sha),
@@ -1052,6 +1058,7 @@ class _DeploymentBase(DeploymentPlugin):
             deployment_url=str(deployment_url) if deployment_url else None,
             description=str(description) if description else None,
             creator=creator_login,
+            creator_subject=creator_subject,
         )
 
     async def _latest_status(

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/tests/test_commits.py

@@ -1,6 +1,7 @@
 """Tests for the GitHub commit / tag history sync webhook plugin."""
 
 import base64
+import datetime
 import time
 import typing
 import unittest
@@ -12,9 +13,12 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from imbi_common.models import CommitRecord, TagRecord
 from imbi_common.plugins.base import PluginContext, ServicePlugin
-from imbi_common.plugins.errors import PluginAuthenticationFailed
+from imbi_common.plugins.errors import (
+    PluginAuthenticationFailed,
+    PluginRateLimited,
+)
 
-from imbi_plugin_github import _app_auth, commits
+from imbi_plugin_github import _app_auth, commits, deployment
 
 _ZERO = '0' * 40
 _CREDS = {'access_token': 'gho_test'}
@@ -111,6 +115,17 @@ def _commit(
     }
 
 
+def _check_runs(
+    conclusion: str | None = 'success', *, status: str = 'completed'
+) -> dict[str, object]:
+    """A ``/check-runs`` payload with a single run."""
+    return {'check_runs': [{'status': status, 'conclusion': conclusion}]}
+
+
+def _check_runs_url(sha: str) -> str:
+    return f'https://api.github.com/repos/octo/demo/commits/{sha}/check-runs'
+
+
 class ConfigTestCase(unittest.TestCase):
     def test_sync_commits_defaults(self) -> None:
         cfg = commits.SyncCommitsConfig()
@@ -423,10 +438,103 @@ class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
             )
 
 
+class SyncCommitsCiStatusTestCase(unittest.IsolatedAsyncioTestCase):
+    """CI status hydration during ``sync_commits``."""
+
+    def setUp(self) -> None:
+        # The /check-runs 403 cache is process-wide module state on the
+        # deployment plugin; clear it so a 403 recorded by one test can't
+        # short-circuit hydration in another.
+        deployment._CHECKS_DISABLED_TOKENS.clear()
+
+    def _mock_compare(self, *shas: str) -> None:
+        base, head = 'a' * 40, 'b' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/compare/{base}...{head}'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'commits': [_commit(s) for s in shas]}
+            )
+        )
+
+    async def _run(self) -> list[CommitRecord]:
+        base, head = 'a' * 40, 'b' * 40
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=commits.SyncCommitsConfig(),
+                event=_event(_push(before=base, after=head)),
+            )
+        _, records = _await_args(insert)
+        return records
+
+    @respx.mock
+    async def test_hydrates_pass_and_fail(self) -> None:
+        self._mock_compare('c' * 40, 'd' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        respx.get(_check_runs_url('d' * 40)).mock(
+            return_value=httpx.Response(200, json=_check_runs('failure'))
+        )
+        records = await self._run()
+        self.assertEqual('pass', records[0].ci_status)
+        self.assertEqual('fail', records[1].ci_status)
+
+    @respx.mock
+    async def test_403_degrades_and_caches(self) -> None:
+        self._mock_compare('c' * 40, 'd' * 40)
+        route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+            return_value=httpx.Response(403)
+        )
+        records = await self._run()
+        # Head probe 403s and records the repo as checks-disabled, so the
+        # tail commit is never probed -- one call, both 'unknown'.
+        self.assertEqual(1, route.call_count)
+        self.assertEqual(
+            ['unknown', 'unknown'], [r.ci_status for r in records]
+        )
+
+    @respx.mock
+    async def test_in_progress_is_unknown(self) -> None:
+        self._mock_compare('c' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            return_value=httpx.Response(
+                200, json=_check_runs(None, status='in_progress')
+            )
+        )
+        records = await self._run()
+        self.assertEqual('unknown', records[0].ci_status)
+
+    @respx.mock
+    async def test_network_error_degrades_to_unknown(self) -> None:
+        self._mock_compare('c' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            side_effect=httpx.ConnectError('boom')
+        )
+        records = await self._run()
+        self.assertEqual('unknown', records[0].ci_status)
+
+    @respx.mock
+    async def test_non_403_http_error_degrades_to_unknown(self) -> None:
+        # A non-200, non-403 response (e.g. 500) is not cached as
+        # checks-disabled, so it degrades to 'unknown' per commit.
+        self._mock_compare('c' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            return_value=httpx.Response(500)
+        )
+        records = await self._run()
+        self.assertEqual('unknown', records[0].ci_status)
+
+
 class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
-    def _tag_push(self, *, after: str = 't' * 40) -> dict[str, object]:
+    def _tag_push(
+        self, *, after: str = 't' * 40, ref: str = 'refs/tags/v1.2.3'
+    ) -> dict[str, object]:
         return {
-            'ref': 'refs/tags/v1.2.3',
+            'ref': ref,
             'after': after,
             'repository': {
                 'full_name': 'octo/demo',
@@ -440,6 +548,16 @@ class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(
             f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
         ).mock(return_value=httpx.Response(404))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(return_value=httpx.Response(404))
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/commits/{sha}'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'committer': {'date': '2026-01-15T12:00:00Z'}}
+            )
+        )
         with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
             await commits.sync_tags(
                 ctx=_ctx(),
@@ -455,10 +573,106 @@ class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual('v1.2.3', records[0].name)
         self.assertEqual(sha, records[0].sha)
         self.assertEqual('', records[0].message)
+        # Lightweight tags carry no tagger date; the target commit's
+        # committer date stands in so the UI doesn't show sync time.
+        self.assertEqual(
+            datetime.datetime.fromisoformat('2026-01-15T12:00:00Z'),
+            records[0].tagged_at,
+        )
+
+    @respx.mock
+    async def test_release_published_date_preferred(self) -> None:
+        # When a GitHub release exists for the tag its published date
+        # wins, and the commit-date fallback is never fetched (respx
+        # would fail the test on the unmocked /git/commits call).
+        sha = 't' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
+        ).mock(return_value=httpx.Response(404))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'published_at': '2026-02-03T04:05:06Z'}
+            )
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_tags(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=commits.SyncTagsConfig(),
+                event=_event(self._tag_push(after=sha)),
+            )
+        _, records = _await_args(insert)
+        self.assertEqual(
+            datetime.datetime.fromisoformat('2026-02-03T04:05:06Z'),
+            records[0].tagged_at,
+        )
+
+    @respx.mock
+    async def test_release_lookup_encodes_slash_in_tag(self) -> None:
+        # A tag like ``release/v1.2.3`` must be encoded as a single
+        # path segment so the GitHub ``/releases/tags/:tag`` route
+        # matches and ``published_at`` is found.
+        sha = 't' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
+        ).mock(return_value=httpx.Response(404))
+        route = respx.get(
+            'https://api.github.com/repos/octo/demo/'
+            'releases/tags/release%2Fv1.2.3'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'published_at': '2026-02-03T04:05:06Z'}
+            )
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_tags(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=commits.SyncTagsConfig(),
+                event=_event(
+                    self._tag_push(after=sha, ref='refs/tags/release/v1.2.3')
+                ),
+            )
+        self.assertTrue(route.called)
+        _, records = _await_args(insert)
+        self.assertEqual(
+            datetime.datetime.fromisoformat('2026-02-03T04:05:06Z'),
+            records[0].tagged_at,
+        )
+
+    @respx.mock
+    async def test_lightweight_tag_date_fetch_failure_degrades(self) -> None:
+        sha = 't' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
+        ).mock(return_value=httpx.Response(404))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(return_value=httpx.Response(404))
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/commits/{sha}'
+        ).mock(return_value=httpx.Response(500))
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_tags(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=commits.SyncTagsConfig(),
+                event=_event(self._tag_push(after=sha)),
+            )
+        _, records = _await_args(insert)
+        self.assertIsNone(records[0].tagged_at)
 
     @respx.mock
     async def test_annotated_tag_metadata(self) -> None:
         sha = 't' * 40
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(return_value=httpx.Response(404))
         respx.get(
             f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
         ).mock(
@@ -493,6 +707,25 @@ class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(
             f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
         ).mock(return_value=httpx.Response(404))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(return_value=httpx.Response(404))
+        respx.get('https://api.github.com/repos/octo/demo/releases').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'tag_name': 'v1.0.0',
+                        'published_at': '2026-02-03T04:05:06Z',
+                    }
+                ],
+            )
+        )
+        respx.get(url__regex=r'.*/git/commits/\w+$').mock(
+            return_value=httpx.Response(
+                200, json={'committer': {'date': '2026-01-15T12:00:00Z'}}
+            )
+        )
         respx.get(
             'https://api.github.com/repos/octo/demo/git/matching-refs/tags'
         ).mock(
@@ -529,6 +762,20 @@ class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
             },
             urls,
         )
+        # v1.0.0 has a GitHub release -> its published date; v1.2.3
+        # does not -> the target commit's committer date.
+        dates = {r.name: r.tagged_at for r in records}
+        self.assertEqual(
+            {
+                'v1.2.3': datetime.datetime.fromisoformat(
+                    '2026-01-15T12:00:00Z'
+                ),
+                'v1.0.0': datetime.datetime.fromisoformat(
+                    '2026-02-03T04:05:06Z'
+                ),
+            },
+            dates,
+        )
 
     @respx.mock
     async def test_reconcile_all_paginates(self) -> None:
@@ -536,6 +783,17 @@ class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(
             f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
         ).mock(return_value=httpx.Response(404))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.2.3'
+        ).mock(return_value=httpx.Response(404))
+        respx.get('https://api.github.com/repos/octo/demo/releases').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        respx.get(url__regex=r'.*/git/commits/\w+$').mock(
+            return_value=httpx.Response(
+                200, json={'committer': {'date': '2026-01-15T12:00:00Z'}}
+            )
+        )
         url = 'https://api.github.com/repos/octo/demo/git/matching-refs/tags'
         respx.get(url).mock(
             side_effect=[
@@ -907,6 +1165,14 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
                 200, json=[_commit('c' * 40), _commit('d' * 40)]
             )
         )
+        respx.get(url__regex=r'.*/git/commits/\w+$').mock(
+            return_value=httpx.Response(
+                200, json={'committer': {'date': '2026-01-15T12:00:00Z'}}
+            )
+        )
+        respx.get(f'{self._REPO}/releases').mock(
+            return_value=httpx.Response(200, json=[])
+        )
         respx.get(f'{self._REPO}/git/matching-refs/tags').mock(
             return_value=httpx.Response(
                 200,
@@ -951,6 +1217,57 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
             urls,
         )
 
+    @respx.mock
+    async def test_bounds_ci_status_to_recent_commits(self) -> None:
+        deployment._CHECKS_DISABLED_TOKENS.clear()
+        self._mock_default_branch()
+        respx.get(f'{self._REPO}/commits').mock(
+            return_value=httpx.Response(
+                200, json=[_commit('c' * 40), _commit('d' * 40)]
+            )
+        )
+        respx.get(f'{self._REPO}/git/matching-refs/tags').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        ci_route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        with mock.patch.object(commits, '_BACKFILL_CI_LIMIT', 1):
+            with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+                await commits.GitHubCommitSyncPlugin().sync_all_history(
+                    ctx=self._ctx(), credentials=_CREDS
+                )
+        # Only the most-recent commit is hydrated; the rest stay 'unknown'.
+        self.assertEqual(1, ci_route.call_count)
+        commit_call = next(
+            c for c in insert.await_args_list if c.args[0] == 'commits'
+        )
+        records = commit_call.args[1]
+        self.assertEqual('pass', records[0].ci_status)
+        self.assertEqual('unknown', records[1].ci_status)
+
+    @respx.mock
+    async def test_rate_limit_beyond_cap_propagates(self) -> None:
+        # The backfill path must NOT swallow PluginRateLimited: it
+        # propagates to the host's queue, which pauses until the reset
+        # and keeps the job queued rather than failing it.
+        respx.get(self._REPO).mock(
+            return_value=httpx.Response(
+                403,
+                headers={
+                    'x-ratelimit-remaining': '0',
+                    'x-ratelimit-reset': str(int(time.time()) + 10_000),
+                },
+            )
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            with self.assertRaises(PluginRateLimited) as caught:
+                await commits.GitHubCommitSyncPlugin().sync_all_history(
+                    ctx=self._ctx(), credentials=_CREDS
+                )
+        self.assertGreater(caught.exception.retry_at, time.time() + 9_000)
+        insert.assert_not_awaited()
+
     @respx.mock
     async def test_paginates_commits(self) -> None:
         self._mock_default_branch()
@@ -1063,6 +1380,9 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(f'{self._REPO}/commits').mock(
             return_value=httpx.Response(200, json=[_commit('c' * 40)])
         )
+        respx.get(f'{self._REPO}/releases').mock(
+            return_value=httpx.Response(200, json=[])
+        )
         tag_sha = 'a' * 40
         respx.get(f'{self._REPO}/git/matching-refs/tags').mock(
             return_value=httpx.Response(
@@ -1159,6 +1479,21 @@ class ThrottleWaitTestCase(unittest.TestCase):
         resp = httpx.Response(403, json={'message': 'Not accessible'})
         self.assertIsNone(commits._throttle_wait(resp))
 
+    def test_secondary_limit_body_without_headers_floors(self) -> None:
+        resp = httpx.Response(
+            403,
+            json={
+                'message': (
+                    'You have exceeded a secondary rate limit. Please wait '
+                    'a few minutes before you try again.'
+                )
+            },
+        )
+        self.assertEqual(
+            commits._SECONDARY_LIMIT_WAIT_SECONDS,
+            commits._throttle_wait(resp),
+        )
+
     def test_healthy_response_no_wait(self) -> None:
         resp = httpx.Response(200, headers={'x-ratelimit-remaining': '4999'})
         self.assertIsNone(commits._throttle_wait(resp))
@@ -1225,7 +1560,7 @@ class RequestTestCase(unittest.IsolatedAsyncioTestCase):
         # The good response is returned, not retried.
         self.assertEqual(1, client.request.await_count)
 
-    async def test_wait_exceeding_cap_bails_without_sleeping(self) -> None:
+    async def test_wait_exceeding_cap_raises_rate_limited(self) -> None:
         reset = int(time.time()) + 10_000
         client = self._client(
             httpx.Response(
@@ -1239,20 +1574,22 @@ class RequestTestCase(unittest.IsolatedAsyncioTestCase):
         with mock.patch.object(
             commits.asyncio, 'sleep', new=mock.AsyncMock()
         ) as slept:
-            resp = await commits._request(client, 'GET', '/x', max_wait=60.0)
-        self.assertEqual(403, resp.status_code)
+            with self.assertRaises(PluginRateLimited) as caught:
+                await commits._request(client, 'GET', '/x', max_wait=60.0)
+        # Bails to the host without sleeping, carrying the resume time.
+        self.assertGreater(caught.exception.retry_at, time.time() + 9_000)
         slept.assert_not_awaited()
         self.assertEqual(1, client.request.await_count)
 
-    async def test_retries_exhausted_bails(self) -> None:
+    async def test_retries_exhausted_raises_rate_limited(self) -> None:
         client = self._client(
             httpx.Response(429, headers={'retry-after': '1'})
         )
         with mock.patch.object(
             commits.asyncio, 'sleep', new=mock.AsyncMock()
         ) as slept:
-            resp = await commits._request(client, 'GET', '/x', max_wait=60.0)
-        self.assertEqual(429, resp.status_code)
+            with self.assertRaises(PluginRateLimited):
+                await commits._request(client, 'GET', '/x', max_wait=60.0)
         self.assertEqual(commits._MAX_THROTTLE_RETRIES, slept.await_count)
         self.assertEqual(
             commits._MAX_THROTTLE_RETRIES + 1, client.request.await_count
@@ -1288,6 +1625,70 @@ class SyncCommitsThrottleTestCase(unittest.IsolatedAsyncioTestCase):
         _, records = _await_args(insert)
         self.assertEqual(1, len(records))
 
+    @respx.mock
+    async def test_rate_limited_beyond_cap_is_swallowed(self) -> None:
+        # A reset further out than the webhook cap makes _request raise
+        # PluginRateLimited; the webhook action swallows it (a later push
+        # re-syncs) rather than letting it 5xx the gateway.
+        base, head = 'a' * 40, 'b' * 40
+        url = f'https://api.github.com/repos/octo/demo/compare/{base}...{head}'
+        respx.get(url).mock(
+            return_value=httpx.Response(
+                403,
+                headers={
+                    'x-ratelimit-remaining': '0',
+                    'x-ratelimit-reset': str(int(time.time()) + 10_000),
+                },
+            )
+        )
+        with mock.patch.object(commits.asyncio, 'sleep', new=mock.AsyncMock()):
+            with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+                await commits.sync_commits(
+                    ctx=_ctx(),
+                    credentials=_CREDS,
+                    external_identifier='',
+                    action_config=commits.SyncCommitsConfig(),
+                    event=_event(_push(before=base, after=head)),
+                )
+        insert.assert_not_awaited()
+
+    @respx.mock
+    async def test_tags_rate_limited_beyond_cap_is_swallowed(self) -> None:
+        # Mirror of the sync_commits swallow path for the tags webhook:
+        # a reset further out than the cap makes _request raise
+        # PluginRateLimited, which sync_tags swallows (a later push
+        # re-syncs) rather than letting it 5xx the gateway.
+        sha = 't' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/tags/{sha}'
+        ).mock(
+            return_value=httpx.Response(
+                403,
+                headers={
+                    'x-ratelimit-remaining': '0',
+                    'x-ratelimit-reset': str(int(time.time()) + 10_000),
+                },
+            )
+        )
+        push = {
+            'ref': 'refs/tags/v1.2.3',
+            'after': sha,
+            'repository': {
+                'full_name': 'octo/demo',
+                'url': 'https://api.github.com/repos/octo/demo',
+            },
+        }
+        with mock.patch.object(commits.asyncio, 'sleep', new=mock.AsyncMock()):
+            with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+                await commits.sync_tags(
+                    ctx=_ctx(),
+                    credentials=_CREDS,
+                    external_identifier='',
+                    action_config=commits.SyncTagsConfig(),
+                    event=_event(push),
+                )
+        insert.assert_not_awaited()
+
 
 class ResolveUserCacheTestCase(unittest.IsolatedAsyncioTestCase):
     """LRU caching of commit-author identity resolution."""

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/tests/test_deployment.py

@@ -857,6 +857,7 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
                         'created_at': '2026-05-13T14:00:00Z',
                         'description': 'Deploy main',
                         'url': 'https://api.github.com/repos/octo/demo/deployments/123',
+                        'creator': {'login': 'octocat', 'id': 583231},
                     }
                 ],
             )
@@ -891,6 +892,11 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
             event.deployment_url,
             'https://api.github.com/repos/octo/demo/deployments/123',
         )
+        # The creator login is kept for display and the numeric id is
+        # surfaced as the identity subject so the host can attribute the
+        # deploy to an Imbi user.
+        self.assertEqual(event.creator, 'octocat')
+        self.assertEqual(event.creator_subject, '583231')
         # ``created_at`` must come from the deployment row, not the
         # latest status row (which is one minute later above).
         self.assertEqual(

{imbi_plugin_github-2.10.0 → imbi_plugin_github-2.11.0}/uv.lock

@@ -667,7 +667,7 @@ wheels = [
 
 [[package]]
 name = "imbi-common"
-version = "2.10.0"
+version = "2.11.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
@@ -683,9 +683,9 @@ dependencies = [
     { name = "python-slugify" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/de/6a/b7787ed646f005df3fcda4c82d4920cb15691f2cd8ac51c6cb30e40f9332/imbi_common-2.10.0.tar.gz", hash = "sha256:0117b56a1d7a7008320df7a4728cf80f044e5493b9253f43ac9642aed379fbca", size = 343896, upload-time = "2026-06-05T23:33:14.061Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/02/30fe936f86936763fd0460c0bf7a8602029ee32de76052063f1322eb54cb/imbi_common-2.11.0.tar.gz", hash = "sha256:fd9126d2ae80fed72902bdcd280a17f992eff6bb80caad7f8979cc07f17ce946", size = 350702, upload-time = "2026-06-11T17:39:16.348Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e7/b6/03d44defd7b1d657db9334f4c940f286ec6a1b5145d331f8a948195472f0/imbi_common-2.10.0-py3-none-any.whl", hash = "sha256:87e914a36f626a2f280273caf4ace7ebc8a40d779b5d18b16431628fb628fe88", size = 111442, upload-time = "2026-06-05T23:33:12.598Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/5d/6adecad7cf2fa1fa0f35e7ca37352f05d504824ba785f6775750f3e442fc/imbi_common-2.11.0-py3-none-any.whl", hash = "sha256:8ca15781dc0285ce412b9158f0162739a9ae82229b193ccf473b01e62688c923", size = 113762, upload-time = "2026-06-11T17:39:14.999Z" },
 ]
 
 [package.optional-dependencies]
@@ -703,7 +703,7 @@ server = [
 
 [[package]]
 name = "imbi-plugin-github"
-version = "2.10.0"
+version = "2.11.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -732,7 +732,7 @@ dist = [
 [package.metadata]
 requires-dist = [
     { name = "httpx", specifier = ">=0.27" },
-    { name = "imbi-common", extras = ["databases"], specifier = "==2.10.0" },
+    { name = "imbi-common", extras = ["databases"], specifier = "==2.11.0" },
     { name = "pydantic", specifier = ">=2" },
     { name = "pyjwt", extras = ["crypto"], specifier = ">=2.8" },
 ]
@@ -741,7 +741,7 @@ requires-dist = [
 dev = [
     { name = "basedpyright" },
     { name = "coverage", extras = ["toml"] },
-    { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.10.0" },
+    { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.11.0" },
     { name = "pre-commit" },
     { name = "pytest" },
     { name = "pytest-asyncio" },