imbi-plugin-github 2.11.5__tar.gz → 2.12.1__tar.gz

{imbi_plugin_github-2.11.5 → imbi_plugin_github-2.12.1}/CLAUDE.md

@@ -5,10 +5,13 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ## What This Is
 
 A set of GitHub plugins for the Imbi platform, distributed as a single
-Python package (`imbi_plugin_github`). It ships **three plugin types**
-(identity, deployment, lifecycle), each in **three host flavors**
-(github.com, GitHub Enterprise Cloud, GitHub Enterprise Server) — nine
-plugins total. The Imbi host discovers them through the
+Python package (`imbi_plugin_github`). It ships **one connection plugin**
+plus **one host-agnostic plugin per behavior** — `github-connection`,
+`github-identity`, `github-deployment`, `github-lifecycle`,
+`github-commit-sync`, `github-pr-sync` (six total). There are no longer
+per-flavor (github.com / GHEC / GHES) variants: the operator picks the
+flavor + host once on the connection plugin, and every behavioral plugin
+reads it from there. The Imbi host discovers them through the
 `imbi.plugins` entry points declared in `pyproject.toml`; that table is
 the registration surface — adding a plugin class means adding an entry
 point there.
@@ -38,21 +41,25 @@ over `src`. Python is pinned to **3.14**; ruff uses single quotes and a
 
 ## Architecture
 
-### The base/subclass/host-flavor pattern
+### The connection-plugin / host-agnostic pattern
 
-Every plugin type follows the same shape: one `_*Base` class holds all
-behavior, and three thin concrete subclasses differ *only* in their
-`_resolve_host(options)` classmethod:
+A single `github-connection` plugin (a `ConnectionPlugin` from
+`imbi_common`, with no behavior) carries the `flavor` option
+(`github.com` / `ghec` / `ghes`), the `host` option, and the shared
+App/PAT credentials for the service. Every behavioral plugin is
+host-agnostic and resolves its host from that connection plugin via the
+`github-connection` entry on `ctx.service_plugins`:
 
-- github.com flavor → returns `'github.com'`.
-- GHEC flavor → reads the required `host` option, validates it's a
-  `*.ghe.com` tenant via `require_ghec_tenant_host`.
-- GHES flavor → reads the required `host` option, normalized only.
+- identity / deployment / lifecycle call `_resolve_host(ctx)` →
+  `resolve_connection_host(ctx.service_plugins, label)`.
+- commit-sync / pr-sync resolve it through `_connection_host` /
+  `_resolve_api_base` (the webhook path also falls back to the explicit
+  `api_base_url`, the service endpoint, and the push payload's
+  `repository.url`, in that order).
 
-`_resolve_host` feeds URL construction, and the three backends route
-differently — this mapping is the single most important thing to keep
-consistent and is **duplicated** across the three modules
-(`identity._endpoints`, `deployment._api_base`, `lifecycle._api_base`):
+`resolve_connection_host` returns a bare host; `host_to_api_base` maps it
+to the REST API base. Routing (the single source of truth in
+`host_to_api_base`, with OAuth URLs built in `identity._endpoints`):
 
 | Host                | REST API base                  | OAuth base (identity only)        |
 | ------------------- | ------------------------------ | --------------------------------- |
@@ -60,14 +67,17 @@ consistent and is **duplicated** across the three modules
 | `<tenant>.ghe.com`  | `https://api.<tenant>.ghe.com` | `https://<tenant>.ghe.com/login/oauth` |
 | GHES `<host>`       | `https://<host>/api/v3`        | `https://<host>/login/oauth`      |
 
-When you change routing for one plugin type, check whether the other two
-need the same change.
+The connection plugin must be populated onto `ctx.service_plugins` by the
+host: imbi-gateway already surfaces every service plugin for the webhook
+path; imbi-api populates it for identity/deployment/lifecycle calls.
 
 ### Shared helpers (single sources of truth)
 
-- `_hosts.py` — `normalize_host` (strip/validate a bare hostname, reject
-  paths/ports/queries) and `require_ghec_tenant_host`. All host-option
-  validation lives here.
+- `_hosts.py` — `normalize_host` / `require_ghec_tenant_host` (host-option
+  validation), `flavor_host` (validate a connection plugin's
+  `flavor`+`host` to a bare host), `find_connection` /
+  `resolve_connection_host` (locate the `github-connection` sibling on
+  `service_plugins`), and `host_to_api_base` (bare host → REST API base).
 - `_repos.py` — `resolve_owner_repo(ctx, host, label)` derives the target
   `(owner, repo)` for deployment and lifecycle calls: it scans
   `ctx.project_links` (preferring the `github-repository` key, skipping

{imbi_plugin_github-2.11.5 → imbi_plugin_github-2.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.11.5
+Version: 2.12.1
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.11.5
+Requires-Dist: imbi-common[databases]==2.12.1
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.11.5 → imbi_plugin_github-2.12.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.11.5"
+version = "2.12.1"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,29 +16,16 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.11.5",
+  "imbi-common[databases]==2.12.1",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]
 
-[project.entry-points."imbi.plugins"]
-github = "imbi_plugin_github.identity:GitHubPlugin"
-github-enterprise-cloud = "imbi_plugin_github.identity:GitHubEnterpriseCloudPlugin"
-github-enterprise-server = "imbi_plugin_github.identity:GitHubEnterpriseServerPlugin"
-github-deployment = "imbi_plugin_github.deployment:GitHubDeploymentPlugin"
-github-deployment-ec = "imbi_plugin_github.deployment:GitHubEnterpriseCloudDeploymentPlugin"
-github-deployment-es = "imbi_plugin_github.deployment:GitHubEnterpriseServerDeploymentPlugin"
-github-lifecycle = "imbi_plugin_github.lifecycle:GitHubLifecyclePlugin"
-github-lifecycle-ec = "imbi_plugin_github.lifecycle:GitHubEnterpriseCloudLifecyclePlugin"
-github-lifecycle-es = "imbi_plugin_github.lifecycle:GitHubEnterpriseServerLifecyclePlugin"
-github-commit-sync = "imbi_plugin_github.commits:GitHubCommitSyncPlugin"
-github-pr-sync = "imbi_plugin_github.pull_requests:GitHubPRSyncPlugin"
-
 [dependency-groups]
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.11.5",
+  "imbi-common[server,databases]==2.12.1",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

imbi_plugin_github-2.12.1/src/imbi_plugin_github/__init__.py

@@ -0,0 +1,13 @@
+"""Imbi GitHub plugin (Architecture v3).
+
+One :class:`~imbi_plugin_github.plugin.GitHubPlugin` backs every GitHub
+Integration. The registry discovers this package by its ``imbi_plugin_*``
+name and reads the module-level :data:`PLUGIN` attribute.
+"""
+
+from imbi_plugin_github.plugin import GitHubPlugin
+
+#: The package's single plugin, discovered by the registry convention scan.
+PLUGIN = GitHubPlugin
+
+__all__ = ['PLUGIN', 'GitHubPlugin']

imbi_plugin_github-2.12.1/src/imbi_plugin_github/_hosts.py

@@ -0,0 +1,113 @@
+"""Shared host resolution utilities for the GitHub plugin.
+
+Every capability resolves the GitHub host (github.com, a GHEC
+``*.ghe.com`` tenant, or a GHES appliance) from the Integration's
+``flavor`` + ``host`` option values, surfaced on
+``PluginContext.integration_options``.  This module is the single source
+of truth for validating those options and mapping the resolved host to
+the REST API base.
+"""
+
+from __future__ import annotations
+
+import logging
+import typing
+import urllib.parse
+
+LOGGER = logging.getLogger(__name__)
+
+
+def normalize_host(raw: typing.Any, label: str) -> str:
+    """Validate and normalize an integration ``host`` value.
+
+    Strips whitespace, accepts an optional scheme, and rejects values
+    with paths / queries / fragments so callers can compose URLs from
+    the result without producing malformed endpoints.
+    """
+    host = str(raw or '').strip()
+    if not host:
+        raise ValueError(f'{label} requires the "host" option')
+    parsed = urllib.parse.urlsplit(
+        host if '://' in host else f'https://{host}'
+    )
+    if (
+        not parsed.hostname
+        or parsed.port is not None
+        or parsed.path not in ('', '/')
+        or parsed.query
+        or parsed.fragment
+    ):
+        raise ValueError(f'{label} got invalid host value: {host!r}')
+    return parsed.hostname
+
+
+def require_ghec_tenant_host(host: str, label: str) -> str:
+    """Refuse anything that isn't a ``*.ghe.com`` tenant host."""
+    if (
+        not host.endswith('.ghe.com')
+        or host == '.ghe.com'
+        or host.startswith('api.')
+    ):
+        raise ValueError(
+            f'{label} requires a tenant host like "tenant.ghe.com"; '
+            f'got {host!r}'
+        )
+    return host
+
+
+def host_to_api_base(host: str) -> str:
+    """Map a resolved GitHub host to its REST API base.
+
+    The single source of truth for GitHub's flavor routing:
+    ``github.com`` -> ``api.github.com``, a ``*.ghe.com`` tenant ->
+    ``api.<tenant>.ghe.com``, and a GHES appliance -> ``<host>/api/v3``.
+    """
+    if host == 'github.com':
+        return 'https://api.github.com'
+    if host.endswith('.ghe.com'):
+        return f'https://api.{host}'
+    return f'https://{host}/api/v3'
+
+
+def flavor_host(options: dict[str, typing.Any], label: str) -> str:
+    """Validate the Integration's ``flavor`` + ``host`` to a bare host.
+
+    The operator picks an explicit ``flavor`` (``github`` / ``ghec`` /
+    ``ghes``); the ``host`` is required for the two enterprise flavors
+    and ignored for ``github``. Returns the bare hostname the rest of the
+    plugin composes URLs against (``github.com``, the validated
+    ``*.ghe.com`` tenant, or the normalized GHES appliance host).
+    """
+    flavor = str(options.get('flavor') or '').strip()
+    if flavor == 'github':
+        return 'github.com'
+    if flavor == 'ghec':
+        host = normalize_host(options.get('host'), label)
+        # Accept a bare tenant slug (e.g. ``aweber``) and compute the full
+        # tenant host; GHEC tenants always live under ``.ghe.com``.
+        if '.' not in host:
+            host = f'{host}.ghe.com'
+        return require_ghec_tenant_host(host, label)
+    if flavor == 'ghes':
+        return normalize_host(options.get('host'), label)
+    raise ValueError(
+        f'{label} got invalid integration flavor {flavor!r}; expected one '
+        f'of "github", "ghec", or "ghes"'
+    )
+
+
+def resolve_host(
+    integration_options: dict[str, typing.Any], label: str
+) -> str | None:
+    """Resolve the GitHub host from the Integration options, or ``None``.
+
+    Returns ``None`` (after logging) when the flavor/host is missing or
+    unusable so callers on the webhook path can fall through to another
+    resolution source rather than failing the delivery. Callers that
+    require a host raise on the ``None``.
+    """
+    try:
+        return flavor_host(integration_options, label)
+    except ValueError as exc:
+        LOGGER.warning('%s: unusable integration flavor/host: %s', label, exc)
+        return None

{imbi_plugin_github-2.11.5 → imbi_plugin_github-2.12.1}/src/imbi_plugin_github/_repos.py

@@ -74,7 +74,7 @@ def derive_owner_repo_from_links(
     """Find a project link pointing at ``host`` and parse owner/repo.
 
     Prefers the dashboard link keyed by ``preferred_key`` (the bound
-    third-party-service slug) when present and pointing at ``host``,
+    Integration slug) when present and pointing at ``host``,
     then the legacy ``github-repository`` link key, then scans the
     remaining same-host links and returns the first usable one.
     Returns ``None`` when nothing matches.
@@ -122,7 +122,7 @@ def resolve_owner_repo(
     derived = derive_owner_repo_from_links(
         ctx.project_links,
         host,
-        preferred_key=ctx.third_party_service_slug,
+        preferred_key=ctx.integration_slug,
     )
     if derived is not None:
         return derived

{imbi_plugin_github-2.11.5 → imbi_plugin_github-2.12.1}/src/imbi_plugin_github/commits.py

@@ -1,28 +1,23 @@
 """GitHub commit / tag history sync (webhook action plugin).
 
-A single :class:`GitHubCommitSyncPlugin` exposes two webhook actions --
-``sync_commits`` and ``sync_tags`` -- dispatched by ``imbi-gateway`` on
-``push`` deliveries. Unlike the identity / deployment / lifecycle
-families, the host (github.com vs. GHEC tenant vs. GHES appliance) is
-*runtime* data on the webhook path rather than a class attribute, so one
-callable serves all three flavors. The API base is resolved per call, in
-order:
+The module exposes two webhook actions -- ``sync_commits`` and
+``sync_tags`` -- dispatched by ``imbi-gateway`` on ``push`` deliveries
+(catalogued by the plugin's ``webhook-actions`` capability). The API base
+is resolved per call, in order:
 
 1. ``api_base_url`` from the rule's ``handler_config`` (explicit
    override), else
-2. the GitHub plugin connected to the same ``ThirdPartyService`` --
-   surfaced on ``ctx.service_plugins`` (slug -> flavor,
-   ``options['host']`` -> host), else
-3. the ``ThirdPartyService.api_endpoint``
-   (``ctx.assignment_options['service_endpoint']``), else
-4. the push payload's ``repository.url`` (already the flavor-correct API
+2. the Integration's ``flavor`` + ``host`` options on
+   ``ctx.integration_options``, else
+3. the push payload's ``repository.url`` (already the flavor-correct API
    URL) as a last resort.
 
-The same plugin also exposes :meth:`GitHubCommitSyncPlugin.sync_all_history`
-for an on-demand, host-invoked backfill: there is no push payload, so the
-GitHub host is read from ``ctx.service_plugins`` and ``(owner, repo)`` from
-the project links; it walks the full default-branch history and the
-complete tag list rather than a single push delta.
+The :class:`GitHubCommitSync` capability handler exposes
+:meth:`~GitHubCommitSync.sync_all_history` for an on-demand, host-invoked
+backfill: there is no push payload, so the GitHub host is read from
+``ctx.integration_options`` and ``(owner, repo)`` from the project links;
+it walks the full default-branch history and the complete tag list rather
+than a single push delta.
 
 Commit / tag rows are written to the shared ClickHouse ``commits`` /
 ``tags`` tables via :func:`imbi_common.clickhouse.insert`. Writes are
@@ -51,20 +46,13 @@ from imbi_common.models import CommitRecord, TagRecord
 from imbi_common.plugins.base import (
     ActionDescriptor,
     CheckStatus,
-    CredentialField,
+    CommitSyncCapability,
     PluginContext,
-    PluginManifest,
-    ServicePlugin,
-    WebhookActionPlugin,
 )
 from imbi_common.plugins.errors import PluginRateLimited
 
 from imbi_plugin_github import _app_auth
-from imbi_plugin_github._hosts import (
-    host_to_api_base,
-    normalize_host,
-    require_ghec_tenant_host,
-)
+from imbi_plugin_github._hosts import host_to_api_base, resolve_host
 from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
@@ -82,10 +70,6 @@ LOGGER = logging.getLogger(__name__)
 
 _HTTP_TIMEOUT_SECONDS = 10.0
 _ZERO_SHA = '0' * 40
-# This plugin's own slug; skipped when reading the GitHub host/flavor
-# from connected ``service_plugins`` so the commit-sync entry can't
-# masquerade as a github.com host on a GHEC/GHES service.
-_SELF_SLUG = 'github-commit-sync'
 # GitHub's compare endpoint caps ``commits[]`` at 250 per page and
 # paginates the rest; bound the walk so a pathological single push
 # (force-push of thousands of commits) can't pin us on one endpoint.
@@ -309,34 +293,6 @@ def _branch_short_name(ref: str) -> str:
     return ref.removeprefix(prefix)
 
 
-def _github_plugin_host(plugin: ServicePlugin) -> str | None:
-    """Resolve the GitHub host from a connected plugin's slug + options.
-
-    Returns ``None`` for non-GitHub plugins and for GitHub plugins whose
-    required ``host`` option is missing or invalid (logged) so the caller
-    can fall through to the next resolution source.
-    """
-    slug = plugin.slug
-    if not slug.startswith('github'):
-        return None
-    label = f'github-commit-sync (via {slug})'
-    try:
-        if slug.endswith('-ec') or slug == 'github-enterprise-cloud':
-            return require_ghec_tenant_host(
-                normalize_host(plugin.options.get('host'), label), label
-            )
-        if slug.endswith('-es') or slug == 'github-enterprise-server':
-            return normalize_host(plugin.options.get('host'), label)
-    except ValueError as exc:
-        LOGGER.warning(
-            'Connected GitHub plugin %r has an unusable host option: %s',
-            slug,
-            exc,
-        )
-        return None
-    return 'github.com'
-
-
 def _api_base_from_repo_url(repo_url: object) -> str | None:
     """Derive the API base from the push payload's ``repository.url``.
 
@@ -363,24 +319,15 @@ def _resolve_api_base(
     """Pick the GitHub API base for this call (see module docstring)."""
     if explicit:
         return explicit.rstrip('/')
-    for plugin in ctx.service_plugins:
-        # Skip our own entry: its slug starts with "github" but carries
-        # no host option, so _github_plugin_host would mis-resolve it to
-        # github.com on a GHEC/GHES service.
-        if plugin.slug == _SELF_SLUG:
-            continue
-        host = _github_plugin_host(plugin)
-        if host:
-            return host_to_api_base(host)
-    endpoint = ctx.assignment_options.get('service_endpoint')
-    if isinstance(endpoint, str) and endpoint:
-        return endpoint.rstrip('/')
+    host = resolve_host(ctx.integration_options, 'github-commit-sync')
+    if host:
+        return host_to_api_base(host)
     base = _api_base_from_repo_url(_resolve(repo_url_pointer, event))
     if base:
         LOGGER.info(
             "github-commit-sync falling back to the event's repository.url "
-            'for the API base; no api_base_url, connected GitHub plugin, or '
-            'service_endpoint was available'
+            'for the API base; no api_base_url or resolvable Integration '
+            'flavor/host was available'
         )
         return base
     return None
@@ -732,20 +679,13 @@ async def _hydrate_ci(
 def _resolve_host_for_context(ctx: PluginContext) -> str | None:
     """Resolve the GitHub web host for an on-demand sync (no payload).
 
-    Walks the connected GitHub plugins on ``ctx.service_plugins`` and
-    returns the first usable host (github.com, a GHEC tenant, or a GHES
-    appliance), skipping this plugin's own entry so a commit-sync row on a
-    GHEC/GHES service can't be read as github.com.  Unlike the webhook
-    path there is no push payload to fall back to, so the absence of a
-    connected GitHub plugin yields ``None``.
+    Reads the Integration's ``flavor`` + ``host`` options from
+    ``ctx.integration_options`` and returns the resolved host (github.com,
+    a GHEC tenant, or a GHES appliance). Unlike the webhook path there is
+    no push payload to fall back to, so a missing/unusable flavor/host
+    yields ``None``.
     """
-    for plugin in ctx.service_plugins:
-        if plugin.slug == _SELF_SLUG:
-            continue
-        host = _github_plugin_host(plugin)
-        if host:
-            return host
-    return None
+    return resolve_host(ctx.integration_options, 'github-commit-sync')
 
 
 async def _fetch_default_branch(
@@ -1278,70 +1218,35 @@ sync_tags_descriptor = ActionDescriptor(
 )
 
 
-class GitHubCommitSyncPlugin(WebhookActionPlugin):
-    """Webhook-action plugin syncing GitHub commit / tag history.
+class GitHubCommitSync(CommitSyncCapability):
+    """Commit / tag history sync capability handler.
 
-    Carries its own service credential -- it is *not* folded into the
-    identity / deployment / lifecycle plugins, which run as the acting
-    user.  Two mutually exclusive auth modes are supported (resolved by
-    :func:`_resolve_bearer`):
-
-    * **PAT** -- a static ``access_token``.
-    * **GitHub App** -- ``app_id`` + ``private_key`` (raw or base64 PEM),
-      with an optional ``installation_id``; the plugin mints a
-      short-lived installation token per call and caches it.
+    Uses the Integration's shared credential blob (resolved by
+    :func:`_resolve_bearer`): a static ``access_token`` PAT when present,
+    otherwise a GitHub App (``app_id`` + ``private_key``, raw or base64
+    PEM, with an optional ``installation_id``) whose short-lived
+    installation token is minted per call and cached.  The gateway-side
+    incremental sync flows through the ``sync_commits`` / ``sync_tags``
+    webhook actions catalogued by the plugin's ``webhook-actions``
+    capability.
     """
 
-    manifest = PluginManifest(
-        slug='github-commit-sync',
-        name='GitHub Commit History Sync',
-        description=(
-            'Syncs commit and tag history from GitHub push webhooks into '
-            'ClickHouse for analytics.'
-        ),
-        plugin_type='webhook',
-        credentials=[
-            CredentialField(
-                name='access_token',
-                label='GitHub Token (PAT)',
-                description=(
-                    'Static personal/service access token. Use this *or* '
-                    'the GitHub App fields below.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='app_id',
-                label='GitHub App ID',
-                description=(
-                    'GitHub App identifier; with a private key the plugin '
-                    'mints short-lived installation tokens.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='private_key',
-                label='GitHub App Private Key',
-                description=(
-                    'App private key, raw PEM or base64-encoded PEM.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='installation_id',
-                label='GitHub App Installation ID',
-                description=(
-                    'Optional. When unset, the installation is discovered '
-                    'from the pushed repository.'
-                ),
-                required=False,
-            ),
-        ],
-    )
-
-    @classmethod
-    def actions(cls) -> list[ActionDescriptor]:
-        return [sync_commits_descriptor, sync_tags_descriptor]
+    async def check_available(
+        self,
+        *,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+    ) -> bool:
+        """Whether an on-demand sync can resolve a host + repo for ``ctx``."""
+        del credentials
+        host = _resolve_host_for_context(ctx)
+        if host is None:
+            return False
+        try:
+            resolve_owner_repo(ctx, host, 'github-commit-sync')
+        except ValueError:
+            return False
+        return True
 
     async def sync_all_history(
         self,
@@ -1352,12 +1257,12 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         """Record the project's full default-branch history and all tags.
 
         Host-invoked (no webhook payload): the host instantiates the
-        plugin, builds a :class:`PluginContext` carrying the project's
-        links and the connected ``service_plugins``, resolves this
-        plugin's service ``credentials``, and awaits this method.  The
-        GitHub host/flavor is read from ``service_plugins``, the
-        ``(owner, repo)`` from the project links, and the bearer token
-        from the same PAT-or-App resolution the webhook actions use.
+        handler, builds a :class:`PluginContext` carrying the project's
+        links and the Integration options, resolves the Integration's
+        ``credentials``, and awaits this method.  The GitHub host/flavor
+        is read from ``ctx.integration_options``, the ``(owner, repo)``
+        from the project links, and the bearer token from the same
+        PAT-or-App resolution the webhook actions use.
 
         Walks every commit reachable from the default branch head plus the
         repo's complete (lightweight) tag list, maps them onto
@@ -1377,7 +1282,7 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         if host is None:
             raise ValueError(
                 'github-commit-sync could not resolve a GitHub host for an '
-                'on-demand sync: connect a GitHub plugin to the service'
+                'on-demand sync: set the Integration flavor/host'
             )
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')