imbi-plugin-github 2.11.6__tar.gz → 2.12.1__tar.gz

{imbi_plugin_github-2.11.6 → imbi_plugin_github-2.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.11.6
+Version: 2.12.1
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.11.6
+Requires-Dist: imbi-common[databases]==2.12.1
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.11.6 → imbi_plugin_github-2.12.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.11.6"
+version = "2.12.1"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,25 +16,16 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.11.6",
+  "imbi-common[databases]==2.12.1",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]
 
-[project.entry-points."imbi.plugins"]
-github-connection = "imbi_plugin_github.connection:GitHubConnectionPlugin"
-github-identity = "imbi_plugin_github.identity:GitHubIdentityPlugin"
-github-deployment = "imbi_plugin_github.deployment:GitHubDeploymentPlugin"
-github-lifecycle = "imbi_plugin_github.lifecycle:GitHubLifecyclePlugin"
-github-commit-sync = "imbi_plugin_github.commits:GitHubCommitSyncPlugin"
-github-pr-sync = "imbi_plugin_github.pull_requests:GitHubPRSyncPlugin"
-github-doctor = "imbi_plugin_github.doctor:GitHubDoctorPlugin"
-
 [dependency-groups]
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.11.6",
+  "imbi-common[server,databases]==2.12.1",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

imbi_plugin_github-2.12.1/src/imbi_plugin_github/__init__.py

@@ -0,0 +1,13 @@
+"""Imbi GitHub plugin (Architecture v3).
+
+One :class:`~imbi_plugin_github.plugin.GitHubPlugin` backs every GitHub
+Integration. The registry discovers this package by its ``imbi_plugin_*``
+name and reads the module-level :data:`PLUGIN` attribute.
+"""
+
+from imbi_plugin_github.plugin import GitHubPlugin
+
+#: The package's single plugin, discovered by the registry convention scan.
+PLUGIN = GitHubPlugin
+
+__all__ = ['PLUGIN', 'GitHubPlugin']

imbi_plugin_github-2.12.1/src/imbi_plugin_github/_hosts.py

@@ -0,0 +1,113 @@
+"""Shared host resolution utilities for the GitHub plugin.
+
+Every capability resolves the GitHub host (github.com, a GHEC
+``*.ghe.com`` tenant, or a GHES appliance) from the Integration's
+``flavor`` + ``host`` option values, surfaced on
+``PluginContext.integration_options``.  This module is the single source
+of truth for validating those options and mapping the resolved host to
+the REST API base.
+"""
+
+from __future__ import annotations
+
+import logging
+import typing
+import urllib.parse
+
+LOGGER = logging.getLogger(__name__)
+
+
+def normalize_host(raw: typing.Any, label: str) -> str:
+    """Validate and normalize an integration ``host`` value.
+
+    Strips whitespace, accepts an optional scheme, and rejects values
+    with paths / queries / fragments so callers can compose URLs from
+    the result without producing malformed endpoints.
+    """
+    host = str(raw or '').strip()
+    if not host:
+        raise ValueError(f'{label} requires the "host" option')
+    parsed = urllib.parse.urlsplit(
+        host if '://' in host else f'https://{host}'
+    )
+    if (
+        not parsed.hostname
+        or parsed.port is not None
+        or parsed.path not in ('', '/')
+        or parsed.query
+        or parsed.fragment
+    ):
+        raise ValueError(f'{label} got invalid host value: {host!r}')
+    return parsed.hostname
+
+
+def require_ghec_tenant_host(host: str, label: str) -> str:
+    """Refuse anything that isn't a ``*.ghe.com`` tenant host."""
+    if (
+        not host.endswith('.ghe.com')
+        or host == '.ghe.com'
+        or host.startswith('api.')
+    ):
+        raise ValueError(
+            f'{label} requires a tenant host like "tenant.ghe.com"; '
+            f'got {host!r}'
+        )
+    return host
+
+
+def host_to_api_base(host: str) -> str:
+    """Map a resolved GitHub host to its REST API base.
+
+    The single source of truth for GitHub's flavor routing:
+    ``github.com`` -> ``api.github.com``, a ``*.ghe.com`` tenant ->
+    ``api.<tenant>.ghe.com``, and a GHES appliance -> ``<host>/api/v3``.
+    """
+    if host == 'github.com':
+        return 'https://api.github.com'
+    if host.endswith('.ghe.com'):
+        return f'https://api.{host}'
+    return f'https://{host}/api/v3'
+
+
+def flavor_host(options: dict[str, typing.Any], label: str) -> str:
+    """Validate the Integration's ``flavor`` + ``host`` to a bare host.
+
+    The operator picks an explicit ``flavor`` (``github`` / ``ghec`` /
+    ``ghes``); the ``host`` is required for the two enterprise flavors
+    and ignored for ``github``. Returns the bare hostname the rest of the
+    plugin composes URLs against (``github.com``, the validated
+    ``*.ghe.com`` tenant, or the normalized GHES appliance host).
+    """
+    flavor = str(options.get('flavor') or '').strip()
+    if flavor == 'github':
+        return 'github.com'
+    if flavor == 'ghec':
+        host = normalize_host(options.get('host'), label)
+        # Accept a bare tenant slug (e.g. ``aweber``) and compute the full
+        # tenant host; GHEC tenants always live under ``.ghe.com``.
+        if '.' not in host:
+            host = f'{host}.ghe.com'
+        return require_ghec_tenant_host(host, label)
+    if flavor == 'ghes':
+        return normalize_host(options.get('host'), label)
+    raise ValueError(
+        f'{label} got invalid integration flavor {flavor!r}; expected one '
+        f'of "github", "ghec", or "ghes"'
+    )
+
+
+def resolve_host(
+    integration_options: dict[str, typing.Any], label: str
+) -> str | None:
+    """Resolve the GitHub host from the Integration options, or ``None``.
+
+    Returns ``None`` (after logging) when the flavor/host is missing or
+    unusable so callers on the webhook path can fall through to another
+    resolution source rather than failing the delivery. Callers that
+    require a host raise on the ``None``.
+    """
+    try:
+        return flavor_host(integration_options, label)
+    except ValueError as exc:
+        LOGGER.warning('%s: unusable integration flavor/host: %s', label, exc)
+        return None

{imbi_plugin_github-2.11.6 → imbi_plugin_github-2.12.1}/src/imbi_plugin_github/_repos.py

@@ -74,7 +74,7 @@ def derive_owner_repo_from_links(
     """Find a project link pointing at ``host`` and parse owner/repo.
 
     Prefers the dashboard link keyed by ``preferred_key`` (the bound
-    third-party-service slug) when present and pointing at ``host``,
+    Integration slug) when present and pointing at ``host``,
     then the legacy ``github-repository`` link key, then scans the
     remaining same-host links and returns the first usable one.
     Returns ``None`` when nothing matches.
@@ -122,7 +122,7 @@ def resolve_owner_repo(
     derived = derive_owner_repo_from_links(
         ctx.project_links,
         host,
-        preferred_key=ctx.third_party_service_slug,
+        preferred_key=ctx.integration_slug,
     )
     if derived is not None:
         return derived

{imbi_plugin_github-2.11.6 → imbi_plugin_github-2.12.1}/src/imbi_plugin_github/commits.py

@@ -1,28 +1,23 @@
 """GitHub commit / tag history sync (webhook action plugin).
 
-A single :class:`GitHubCommitSyncPlugin` exposes two webhook actions --
-``sync_commits`` and ``sync_tags`` -- dispatched by ``imbi-gateway`` on
-``push`` deliveries. Unlike the identity / deployment / lifecycle
-families, the host (github.com vs. GHEC tenant vs. GHES appliance) is
-*runtime* data on the webhook path rather than a class attribute, so one
-callable serves all three flavors. The API base is resolved per call, in
-order:
+The module exposes two webhook actions -- ``sync_commits`` and
+``sync_tags`` -- dispatched by ``imbi-gateway`` on ``push`` deliveries
+(catalogued by the plugin's ``webhook-actions`` capability). The API base
+is resolved per call, in order:
 
 1. ``api_base_url`` from the rule's ``handler_config`` (explicit
    override), else
-2. the GitHub plugin connected to the same ``ThirdPartyService`` --
-   surfaced on ``ctx.service_plugins`` (slug -> flavor,
-   ``options['host']`` -> host), else
-3. the ``ThirdPartyService.api_endpoint``
-   (``ctx.assignment_options['service_endpoint']``), else
-4. the push payload's ``repository.url`` (already the flavor-correct API
+2. the Integration's ``flavor`` + ``host`` options on
+   ``ctx.integration_options``, else
+3. the push payload's ``repository.url`` (already the flavor-correct API
    URL) as a last resort.
 
-The same plugin also exposes :meth:`GitHubCommitSyncPlugin.sync_all_history`
-for an on-demand, host-invoked backfill: there is no push payload, so the
-GitHub host is read from ``ctx.service_plugins`` and ``(owner, repo)`` from
-the project links; it walks the full default-branch history and the
-complete tag list rather than a single push delta.
+The :class:`GitHubCommitSync` capability handler exposes
+:meth:`~GitHubCommitSync.sync_all_history` for an on-demand, host-invoked
+backfill: there is no push payload, so the GitHub host is read from
+``ctx.integration_options`` and ``(owner, repo)`` from the project links;
+it walks the full default-branch history and the complete tag list rather
+than a single push delta.
 
 Commit / tag rows are written to the shared ClickHouse ``commits`` /
 ``tags`` tables via :func:`imbi_common.clickhouse.insert`. Writes are
@@ -51,19 +46,13 @@ from imbi_common.models import CommitRecord, TagRecord
 from imbi_common.plugins.base import (
     ActionDescriptor,
     CheckStatus,
-    CredentialField,
+    CommitSyncCapability,
     PluginContext,
-    PluginManifest,
-    WebhookActionPlugin,
 )
 from imbi_common.plugins.errors import PluginRateLimited
 
 from imbi_plugin_github import _app_auth
-from imbi_plugin_github._hosts import (
-    find_connection,
-    flavor_host,
-    host_to_api_base,
-)
+from imbi_plugin_github._hosts import host_to_api_base, resolve_host
 from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
@@ -304,28 +293,6 @@ def _branch_short_name(ref: str) -> str:
     return ref.removeprefix(prefix)
 
 
-def _connection_host(ctx: PluginContext, label: str) -> str | None:
-    """Resolve the GitHub host from the ``github-connection`` sibling.
-
-    Returns ``None`` when no connection plugin is attached so callers can
-    fall through to the next resolution source. A connection plugin that
-    *is* present but carries an unusable flavor/host is logged and also
-    treated as a fall-through rather than failing the delivery.
-    """
-    plugin = find_connection(ctx.service_plugins)
-    if plugin is None:
-        return None
-    try:
-        return flavor_host(plugin.options, label)
-    except ValueError as exc:
-        LOGGER.warning(
-            '%s: github-connection plugin has an unusable flavor/host: %s',
-            label,
-            exc,
-        )
-        return None
-
-
 def _api_base_from_repo_url(repo_url: object) -> str | None:
     """Derive the API base from the push payload's ``repository.url``.
 
@@ -352,18 +319,15 @@ def _resolve_api_base(
     """Pick the GitHub API base for this call (see module docstring)."""
     if explicit:
         return explicit.rstrip('/')
-    host = _connection_host(ctx, 'github-commit-sync')
+    host = resolve_host(ctx.integration_options, 'github-commit-sync')
     if host:
         return host_to_api_base(host)
-    endpoint = ctx.assignment_options.get('service_endpoint')
-    if isinstance(endpoint, str) and endpoint:
-        return endpoint.rstrip('/')
     base = _api_base_from_repo_url(_resolve(repo_url_pointer, event))
     if base:
         LOGGER.info(
             "github-commit-sync falling back to the event's repository.url "
-            'for the API base; no api_base_url, connected GitHub plugin, or '
-            'service_endpoint was available'
+            'for the API base; no api_base_url or resolvable Integration '
+            'flavor/host was available'
         )
         return base
     return None
@@ -715,12 +679,13 @@ async def _hydrate_ci(
 def _resolve_host_for_context(ctx: PluginContext) -> str | None:
     """Resolve the GitHub web host for an on-demand sync (no payload).
 
-    Reads the ``github-connection`` sibling on ``ctx.service_plugins``
-    and returns its resolved host (github.com, a GHEC tenant, or a GHES
-    appliance). Unlike the webhook path there is no push payload to fall
-    back to, so the absence of a connection plugin yields ``None``.
+    Reads the Integration's ``flavor`` + ``host`` options from
+    ``ctx.integration_options`` and returns the resolved host (github.com,
+    a GHEC tenant, or a GHES appliance). Unlike the webhook path there is
+    no push payload to fall back to, so a missing/unusable flavor/host
+    yields ``None``.
     """
-    return _connection_host(ctx, 'github-commit-sync')
+    return resolve_host(ctx.integration_options, 'github-commit-sync')
 
 
 async def _fetch_default_branch(
@@ -1253,70 +1218,35 @@ sync_tags_descriptor = ActionDescriptor(
 )
 
 
-class GitHubCommitSyncPlugin(WebhookActionPlugin):
-    """Webhook-action plugin syncing GitHub commit / tag history.
-
-    Carries its own service credential -- it is *not* folded into the
-    identity / deployment / lifecycle plugins, which run as the acting
-    user.  Two mutually exclusive auth modes are supported (resolved by
-    :func:`_resolve_bearer`):
+class GitHubCommitSync(CommitSyncCapability):
+    """Commit / tag history sync capability handler.
 
-    * **PAT** -- a static ``access_token``.
-    * **GitHub App** -- ``app_id`` + ``private_key`` (raw or base64 PEM),
-      with an optional ``installation_id``; the plugin mints a
-      short-lived installation token per call and caches it.
+    Uses the Integration's shared credential blob (resolved by
+    :func:`_resolve_bearer`): a static ``access_token`` PAT when present,
+    otherwise a GitHub App (``app_id`` + ``private_key``, raw or base64
+    PEM, with an optional ``installation_id``) whose short-lived
+    installation token is minted per call and cached.  The gateway-side
+    incremental sync flows through the ``sync_commits`` / ``sync_tags``
+    webhook actions catalogued by the plugin's ``webhook-actions``
+    capability.
     """
 
-    manifest = PluginManifest(
-        slug='github-commit-sync',
-        name='GitHub Commit History Sync',
-        description=(
-            'Syncs commit and tag history from GitHub push webhooks into '
-            'ClickHouse for analytics.'
-        ),
-        plugin_type='webhook',
-        credentials=[
-            CredentialField(
-                name='access_token',
-                label='GitHub Token (PAT)',
-                description=(
-                    'Static personal/service access token. Use this *or* '
-                    'the GitHub App fields below.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='app_id',
-                label='GitHub App ID',
-                description=(
-                    'GitHub App identifier; with a private key the plugin '
-                    'mints short-lived installation tokens.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='private_key',
-                label='GitHub App Private Key',
-                description=(
-                    'App private key, raw PEM or base64-encoded PEM.'
-                ),
-                required=False,
-            ),
-            CredentialField(
-                name='installation_id',
-                label='GitHub App Installation ID',
-                description=(
-                    'Optional. When unset, the installation is discovered '
-                    'from the pushed repository.'
-                ),
-                required=False,
-            ),
-        ],
-    )
-
-    @classmethod
-    def actions(cls) -> list[ActionDescriptor]:
-        return [sync_commits_descriptor, sync_tags_descriptor]
+    async def check_available(
+        self,
+        *,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+    ) -> bool:
+        """Whether an on-demand sync can resolve a host + repo for ``ctx``."""
+        del credentials
+        host = _resolve_host_for_context(ctx)
+        if host is None:
+            return False
+        try:
+            resolve_owner_repo(ctx, host, 'github-commit-sync')
+        except ValueError:
+            return False
+        return True
 
     async def sync_all_history(
         self,
@@ -1327,12 +1257,12 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         """Record the project's full default-branch history and all tags.
 
         Host-invoked (no webhook payload): the host instantiates the
-        plugin, builds a :class:`PluginContext` carrying the project's
-        links and the connected ``service_plugins``, resolves this
-        plugin's service ``credentials``, and awaits this method.  The
-        GitHub host/flavor is read from ``service_plugins``, the
-        ``(owner, repo)`` from the project links, and the bearer token
-        from the same PAT-or-App resolution the webhook actions use.
+        handler, builds a :class:`PluginContext` carrying the project's
+        links and the Integration options, resolves the Integration's
+        ``credentials``, and awaits this method.  The GitHub host/flavor
+        is read from ``ctx.integration_options``, the ``(owner, repo)``
+        from the project links, and the bearer token from the same
+        PAT-or-App resolution the webhook actions use.
 
         Walks every commit reachable from the default branch head plus the
         repo's complete (lightweight) tag list, maps them onto
@@ -1352,7 +1282,7 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         if host is None:
             raise ValueError(
                 'github-commit-sync could not resolve a GitHub host for an '
-                'on-demand sync: connect a GitHub plugin to the service'
+                'on-demand sync: set the Integration flavor/host'
             )
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')

{imbi_plugin_github-2.11.6 → imbi_plugin_github-2.12.1}/src/imbi_plugin_github/deployment.py

@@ -1,9 +1,8 @@
-"""GitHub deployment plugin.
+"""GitHub deployment capability handler.
 
-A single :class:`GitHubDeploymentPlugin` resolves its host from the
-``github-connection`` plugin attached to the same ``ThirdPartyService``
-(github.com, a ``*.ghe.com`` GHEC tenant, or an operator-managed GHES
-appliance) instead of shipping a per-flavor subclass.
+:class:`GitHubDeployment` resolves its host from the Integration's
+``flavor`` + ``host`` options on ``ctx.integration_options`` (github.com,
+a ``*.ghe.com`` GHEC tenant, or an operator-managed GHES appliance).
 
 It drives the GitHub Deployments API
 (``POST /repos/{owner}/{repo}/deployments``) rather than
@@ -14,9 +13,9 @@ Tag/release creation is handled separately by ``create_tag`` and
 ``create_release`` and continues to feed projects whose deploys are
 triggered by ``on: release: [published]`` instead of ``on: deployment``.
 
-The plugin runs as the user via the paired ``IdentityPlugin``: callers
-materialize an :class:`~imbi_common.plugins.base.IdentityCredentials`
-and pass the access token through ``credentials['access_token']``.
+The handler runs as the acting user: the host passes the materialized
+access token through the Integration credential blob's
+``credentials['access_token']``.
 """
 
 from __future__ import annotations
@@ -36,16 +35,11 @@ from imbi_common.plugins.base import (
     CheckStatus,
     Commit,
     CompareResult,
-    CredentialField,
+    DeploymentCapability,
     DeploymentEventStatus,
-    DeploymentPlugin,
     DeploymentRun,
     LinkWriteback,
-    OpsLogTemplate,
     PluginContext,
-    PluginEdgeLabel,
-    PluginManifest,
-    PluginOption,
     Ref,
     RefInfo,
     ReleaseInfo,
@@ -54,10 +48,7 @@ from imbi_common.plugins.base import (
 )
 from imbi_common.plugins.errors import PluginAuthenticationFailed
 
-from imbi_plugin_github._hosts import (
-    host_to_api_base,
-    resolve_connection_host,
-)
+from imbi_plugin_github._hosts import flavor_host, host_to_api_base
 from imbi_plugin_github._repos import (
     derive_owner_repo_from_links,
     parse_owner_repo,
@@ -287,19 +278,18 @@ def _check_runs_to_status(
     return 'unknown'
 
 
-class _DeploymentBase(DeploymentPlugin):
-    """Shared base for the GitHub deployment plugin.
+class GitHubDeployment(DeploymentCapability):
+    """GitHub deployment capability handler.
 
-    The host is resolved per call from the ``github-connection`` sibling
-    on the same service via :meth:`_resolve_host`.  Each plugin instance
-    is single-shot: callers pass ``credentials`` (from the paired
-    :class:`IdentityPlugin`) and ``ctx`` per call.
+    The host is resolved per call from the Integration's ``flavor`` +
+    ``host`` options via :meth:`_resolve_host`.  Each instance is
+    single-shot: callers pass ``credentials`` (the Integration's
+    decrypted blob, carrying the acting user's access token) and ``ctx``
+    per call.
     """
 
     def _resolve_host(self, ctx: PluginContext) -> str:
-        return resolve_connection_host(
-            ctx.service_plugins, 'github-deployment'
-        )
+        return flavor_host(ctx.integration_options, 'github deployment')
 
     def _api_base(self, ctx: PluginContext) -> str:
         return host_to_api_base(self._resolve_host(ctx))
@@ -1113,73 +1103,3 @@ def _to_event_status(github_state: str) -> DeploymentEventStatus:
     if github_state == 'inactive':
         return 'rolled_back'
     return 'pending'
-
-
-_COMMON_OPTIONS: list[PluginOption] = []
-
-# Promote behaviour is now inferred from the ``body.tag`` shape on the
-# imbi-api side: semver tags trigger a Deployment, raw SHAs cut a tag
-# + GitHub Release.  Per-env workflow input overrides live on the
-# ``USES_PLUGIN`` edge under ``env_payloads`` (keyed by env slug),
-# resolved by the host and passed in via ``ctx.environment_config``.
-_COMMON_EDGE_LABELS: list[PluginEdgeLabel] = []
-
-_COMMON_CREDENTIALS: list[CredentialField] = [
-    CredentialField(
-        name='access_token',
-        label='Service-account PAT (optional fallback)',
-        description=(
-            'Personal access token used when no per-user identity is '
-            'bound.  Requires contents:write and actions:write scopes.'
-        ),
-        required=False,
-    ),
-]
-
-
-# Templates for the operations-log JSON payload the API writes from
-# ``_record_deployment_event`` in imbi-api: ``{action, plugin_slug,
-# run_url, release_url, from_environment}``.  Row-level fields
-# ``version`` and ``environment`` (from the entry's
-# ``environment_slug``/``environment.name``) are also in scope.
-_COMMON_OPS_LOG_TEMPLATES: dict[str, OpsLogTemplate] = {
-    'deploy': OpsLogTemplate(
-        label='Deployed {{version}} to {{environment}}',
-        summary='deployed',
-    ),
-    'redeploy': OpsLogTemplate(
-        label='Re-deployed {{version}} to {{environment}}',
-        summary='re-deployed',
-    ),
-    'promote': OpsLogTemplate(
-        label=(
-            'Promoted {{from_environment}} to {{environment}} as {{version}}.'
-        ),
-        summary='promoted',
-    ),
-    'resync': OpsLogTemplate(
-        label='Recorded {{version}} deploy in {{environment}}',
-        summary='recorded a deploy in',
-    ),
-}
-
-
-class GitHubDeploymentPlugin(_DeploymentBase):
-    manifest = PluginManifest(
-        slug='github-deployment',
-        name='GitHub Deployment',
-        description=(
-            'Drive GitHub Deployments and record GitHub Releases '
-            'on behalf of an Imbi project.  Each promote creates a '
-            'Deployment object so GitHub environment protection rules '
-            '(required reviewers, branch policies, wait timers) apply '
-            'server-side.  The GitHub host is resolved from the '
-            '``github-connection`` plugin on the same service.'
-        ),
-        plugin_type='deployment',
-        supports_deployment_sync=True,
-        options=_COMMON_OPTIONS,
-        credentials=_COMMON_CREDENTIALS,
-        edge_labels=_COMMON_EDGE_LABELS,
-        ops_log_templates=_COMMON_OPS_LOG_TEMPLATES,
-    )