imbi-plugin-github 2.13.3__tar.gz → 2.14.0__tar.gz

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.13.3
+Version: 2.14.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.13.3
+Requires-Dist: imbi-common[databases]==2.14.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.13.3"
+version = "2.14.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,7 +16,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.13.3",
+  "imbi-common[databases]==2.14.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]
@@ -25,7 +25,7 @@ dependencies = [
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.13.3",
+  "imbi-common[server,databases]==2.14.0",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/src/imbi_plugin_github/_app_auth.py

@@ -33,6 +33,18 @@ from imbi_plugin_github.deployment import (
 
 LOGGER = logging.getLogger(__name__)
 
+
+class AppNotInstalledError(Exception):
+    """The GitHub App is not installed for the target repository.
+
+    Raised by :func:`_discover_installation_id` when GitHub answers the
+    installation lookup with a 404 -- the App has not been installed on
+    the repo/org, or the repo was renamed/removed.  Sync callers treat
+    this as a clean skip rather than a hard failure, so an uninstalled
+    App never surfaces as a Sentry error on a backfill worker.
+    """
+
+
 _HTTP_TIMEOUT_SECONDS = 10.0
 # GitHub rejects an App JWT whose ``exp`` is more than 10 minutes out;
 # sign for 9 to leave room for clock skew between us and GitHub.
@@ -114,11 +126,15 @@ async def _discover_installation_id(
     client: httpx.AsyncClient, owner: str, repo: str
 ) -> str:
     resp = await client.get(f'/repos/{owner}/{repo}/installation')
+    if resp.status_code == 404:
+        raise AppNotInstalledError(
+            f'no GitHub App installation found for {owner}/{repo}'
+        )
     resp.raise_for_status()
     data = typing.cast('dict[str, typing.Any]', resp.json())
     install_id = data.get('id')
     if install_id is None:
-        raise ValueError(
+        raise AppNotInstalledError(
             f'no GitHub App installation found for {owner}/{repo}'
         )
     return str(install_id)
@@ -193,3 +209,37 @@ async def installation_token(
         _token_deadline(expires_at),
     )
     return token
+
+
+async def resolve_bearer(
+    credentials: dict[str, str], base: str, owner: str, repo: str
+) -> str:
+    """Resolve the Bearer token used for a repo's GitHub API calls.
+
+    Prefers an explicit PAT (``access_token``/``token``).  Otherwise mints
+    a short-lived GitHub App installation token from ``app_id`` +
+    ``private_key`` (with an optional ``installation_id`` that skips
+    per-repo installation discovery).  Tokens are cached process-wide.
+
+    Shared by every host-agnostic behavioral plugin (commit-sync,
+    pr-sync, deployment) so a service configured with only App
+    credentials -- and therefore no acting user -- can still act.
+    """
+    token = credentials.get('access_token') or credentials.get('token')
+    if token:
+        return token
+    app_id = credentials.get('app_id')
+    private_key = credentials.get('private_key')
+    if app_id and private_key:
+        return await installation_token(
+            base=base,
+            app_id=app_id,
+            private_key=private_key,
+            installation_id=credentials.get('installation_id') or None,
+            owner=owner,
+            repo=repo,
+        )
+    raise ValueError(
+        'GitHub plugin requires either an access_token (PAT) or '
+        'app_id + private_key (GitHub App) credentials'
+    )

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/src/imbi_plugin_github/commits.py

@@ -254,30 +254,11 @@ async def _resolve_bearer(
 ) -> str:
     """Resolve the Bearer token used for the repo's GitHub API calls.
 
-    Prefers an explicit PAT (``access_token``/``token``).  Otherwise
-    mints a short-lived GitHub App installation token from ``app_id`` +
-    ``private_key`` (with an optional ``installation_id`` that skips
-    per-repo installation discovery).  Tokens are cached process-wide by
-    :mod:`imbi_plugin_github._app_auth`.
+    Thin wrapper over :func:`imbi_plugin_github._app_auth.resolve_bearer`
+    (the single source of truth), kept as a module-local name for the
+    commit-sync call sites and tests.
     """
-    token = credentials.get('access_token') or credentials.get('token')
-    if token:
-        return token
-    app_id = credentials.get('app_id')
-    private_key = credentials.get('private_key')
-    if app_id and private_key:
-        return await _app_auth.installation_token(
-            base=base,
-            app_id=app_id,
-            private_key=private_key,
-            installation_id=credentials.get('installation_id') or None,
-            owner=owner,
-            repo=repo,
-        )
-    raise ValueError(
-        'github-commit-sync requires either an access_token (PAT) or '
-        'app_id + private_key (GitHub App) credentials'
-    )
+    return await _app_auth.resolve_bearer(credentials, base, owner, repo)
 
 
 def _resolve(pointer: jsonpointer.JsonPointer, event: object) -> object:
@@ -1273,7 +1254,10 @@ class GitHubCommitSync(CommitSyncCapability):
         Returns ``(commits_recorded, tags_recorded)``.  Raises
         :class:`ValueError` only when the host or repository can't be
         resolved; ClickHouse failures are swallowed (the count reflects
-        what was written).  Propagates :class:`PluginRateLimited` when a
+        what was written).  Returns ``(0, 0)`` (logged as a warning, no
+        error) when the GitHub App is not installed for the repo, so an
+        uninstalled App never fails the backfill worker.  Propagates
+        :class:`PluginRateLimited` when a
         GitHub rate-limit reset is further out than
         ``_BACKFILL_MAX_WAIT_SECONDS`` so the host can pause the worker and
         keep the job queued until GitHub resumes rather than fail it.
@@ -1287,7 +1271,15 @@ class GitHubCommitSync(CommitSyncCapability):
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')
         pushed_at = datetime.datetime.now(datetime.UTC)
-        token = await _resolve_bearer(credentials, base, owner, repo)
+        try:
+            token = await _resolve_bearer(credentials, base, owner, repo)
+        except _app_auth.AppNotInstalledError as exc:
+            LOGGER.warning(
+                'github-commit-sync: %s; skipping backfill for project %s',
+                exc,
+                ctx.project_id,
+            )
+            return 0, 0
         async with _client(base, owner, repo, token) as client:
             branch = await _fetch_default_branch(
                 client, max_wait=_BACKFILL_MAX_WAIT_SECONDS

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/src/imbi_plugin_github/deployment.py

@@ -236,6 +236,49 @@ def _record_checks_disabled(
     _CHECKS_DISABLED_TOKENS[key] = now
 
 
+# Process-wide 403 suppression for release-notes lookups, mirroring the
+# check-runs cache above: a token that lacks the scope to read releases
+# must not re-issue ``GET /releases/tags/{ref}`` for every deployment on
+# every resync sweep.  Keyed by a hash of the repo-scoped client's base
+# URL (host + ``owner/repo``) plus its bearer header (the token), so a
+# single forbidden repo doesn't suppress release reads elsewhere.
+_RELEASES_FORBIDDEN_TOKENS: dict[str, float] = {}
+
+
+def _releases_cache_key(client: httpx.AsyncClient) -> str:
+    material = f'{client.base_url}\n{client.headers.get("authorization", "")}'
+    return hashlib.sha256(material.encode()).hexdigest()
+
+
+def _releases_forbidden(client: httpx.AsyncClient) -> bool:
+    """Whether this client's token has recently 403'd on releases."""
+    key = _releases_cache_key(client)
+    recorded = _RELEASES_FORBIDDEN_TOKENS.get(key)
+    if recorded is None:
+        return False
+    if time.monotonic() - recorded > _CHECKS_DISABLED_TTL_SECONDS:
+        _RELEASES_FORBIDDEN_TOKENS.pop(key, None)
+        return False
+    return True
+
+
+def _record_releases_forbidden(client: httpx.AsyncClient) -> None:
+    """Mark this client's token as forbidden from releases for the TTL.
+
+    Opportunistically evicts expired entries so the dict can't grow
+    unbounded, mirroring :func:`_record_checks_disabled`.
+    """
+    now = time.monotonic()
+    expired = [
+        k
+        for k, recorded in _RELEASES_FORBIDDEN_TOKENS.items()
+        if now - recorded > _CHECKS_DISABLED_TTL_SECONDS
+    ]
+    for k in expired:
+        _RELEASES_FORBIDDEN_TOKENS.pop(k, None)
+    _RELEASES_FORBIDDEN_TOKENS[_releases_cache_key(client)] = now
+
+
 def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     """Convert a GitHub commit list/object payload into a :class:`Commit`."""
     sha = str(payload.get('sha', ''))
@@ -322,15 +365,25 @@ class GitHubDeployment(DeploymentCapability):
             return value.strip()
         return default
 
-    @staticmethod
-    def _token(credentials: dict[str, str]) -> str:
-        token = credentials.get('access_token') or credentials.get('token')
-        if not token:
-            raise ValueError(
-                'GitHub deployment plugin requires an OAuth access token; '
-                'expected ``credentials["access_token"]``'
-            )
-        return token
+    async def _bearer(
+        self, ctx: PluginContext, credentials: dict[str, str]
+    ) -> str:
+        """Resolve the Bearer token for this deployment call.
+
+        Prefers the per-user OAuth token the host threads in as
+        ``access_token``; when a service configured with only GitHub App
+        credentials drives the call (e.g. the headless deployment-resync
+        sweep, which has no acting user), mints an installation token
+        from ``app_id`` + ``private_key`` instead.
+        """
+        # Local import: ``_app_auth`` imports this module for its shared
+        # HTTP helpers, so a top-level import here would be circular.
+        from imbi_plugin_github import _app_auth
+
+        owner, repo = self._owner_repo(ctx)
+        return await _app_auth.resolve_bearer(
+            credentials, self._api_base(ctx), owner, repo
+        )
 
     @contextlib.asynccontextmanager
     async def _client(
@@ -358,7 +411,7 @@ class GitHubDeployment(DeploymentCapability):
 
         client = httpx.AsyncClient(
             timeout=_HTTP_TIMEOUT_SECONDS,
-            headers=_auth_headers(self._token(credentials)),
+            headers=_auth_headers(await self._bearer(ctx, credentials)),
             base_url=self._repo_url(ctx),
             follow_redirects=True,
             event_hooks={'response': [_capture_redirect, _raise_on_401]},
@@ -388,7 +441,7 @@ class GitHubDeployment(DeploymentCapability):
             return
         try:
             resp = await client.get(repo_root)
-        except (httpx.HTTPError, PluginAuthenticationFailed):
+        except httpx.HTTPError, PluginAuthenticationFailed:
             # The user-facing request already succeeded; a probe failure
             # (network, or a 401 surfaced by the response hook) must not
             # turn that success into an error during teardown.
@@ -1022,6 +1075,11 @@ class GitHubDeployment(DeploymentCapability):
         )
         ref_value = deployment.get('ref')
         description = deployment.get('description')
+        release_notes = (
+            await self._release_notes_for_ref(client, str(ref_value))
+            if ref_value
+            else None
+        )
         deployment_url = deployment.get('url') or deployment.get('html_url')
         creator_login: str | None = None
         creator_subject: str | None = None
@@ -1046,10 +1104,45 @@ class GitHubDeployment(DeploymentCapability):
             run_url=status_url,
             deployment_url=str(deployment_url) if deployment_url else None,
             description=str(description) if description else None,
+            release_notes=release_notes,
             creator=creator_login,
             creator_subject=creator_subject,
         )
 
+    async def _release_notes_for_ref(
+        self, client: httpx.AsyncClient, ref: str
+    ) -> str | None:
+        """Return the GitHub release notes body for a deployed ref.
+
+        A deployment created against a semver tag has a matching GitHub
+        release whose ``body`` is the "What's Changed" markdown the host
+        persists on the ``Release`` node.  Refs that aren't a release tag
+        (branches, raw SHAs) 404 here and yield ``None`` -- resync is
+        never blocked by a missing or unreadable release.  A ``403``
+        (token lacks scope to read releases) is cached process-wide so a
+        forbidden token short-circuits instead of re-issuing the request
+        for every deployment on every resync sweep.
+        """
+        if _releases_forbidden(client):
+            return None
+        try:
+            resp = await client.get(
+                f'/releases/tags/{urllib.parse.quote(ref, safe="")}'
+            )
+        except httpx.HTTPError:
+            return None
+        if resp.status_code == 403:
+            _record_releases_forbidden(client)
+            return None
+        if resp.status_code != 200:
+            return None
+        try:
+            data = typing.cast(dict[str, typing.Any], resp.json())
+        except ValueError:
+            return None
+        body = data.get('body')
+        return str(body) if body else None
+
     async def _latest_status(
         self, client: httpx.AsyncClient, deployment_id: str
     ) -> tuple[DeploymentEventStatus, str | None]:

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/src/imbi_plugin_github/doctor.py

@@ -15,6 +15,7 @@ its own.
 
 from __future__ import annotations
 
+import logging
 import re
 import typing
 
@@ -37,6 +38,11 @@ from imbi_plugin_github._hosts import (
     host_to_api_base,
 )
 from imbi_plugin_github._repos import derive_owner_repo_from_links
+from imbi_plugin_github.commits import (
+    _resolve_bearer,  # pyright: ignore[reportPrivateUsage]
+)
+
+LOGGER = logging.getLogger(__name__)
 
 _TIMEOUT = 15.0
 # Matches the canonical URL shape written by the lifecycle plugin:
@@ -100,7 +106,7 @@ def _item(
 
 
 def _repo_fetch_url(
-    connection: ServiceConnection,
+    connection: ServiceConnection | None,
     ctx: PluginContext,
     host: str,
     api_base: str,
@@ -109,7 +115,9 @@ def _repo_fetch_url(
 
     Prefer the rename-stable canonical URL on the ``EXISTS_IN`` edge;
     otherwise derive ``(owner, repo)`` from the project links. Returns
-    ``None`` when neither is available.
+    ``None`` when neither is available. ``connection`` is ``None`` when
+    no ``EXISTS_IN`` edge exists yet (the create-edge remediation), in
+    which case the URL is derived from the project links alone.
 
     The stored canonical URL is never fetched verbatim: only the numeric
     repository id is trusted from it, and the request URL is rebuilt
@@ -117,7 +125,7 @@ def _repo_fetch_url(
     truth). This keeps the Bearer token from ever being sent to an
     arbitrary host smuggled onto the ``EXISTS_IN`` edge.
     """
-    if connection.canonical_url:
+    if connection is not None and connection.canonical_url:
         match = _REPO_ID_RE.fullmatch(connection.canonical_url)
         if match is not None:
             return f'{api_base}/repositories/{match.group(1)}'
@@ -147,6 +155,38 @@ def _find_connection(
     )
 
 
+async def _resolve_doctor_bearer(
+    credentials: dict[str, str],
+    api_base: str,
+    ctx: PluginContext,
+    host: str,
+) -> str | None:
+    """Resolve a Bearer token for analysis / remediation, or ``None``.
+
+    Accepts the same credential shapes as the sync capabilities via
+    :func:`_resolve_bearer` — a PAT (``access_token`` / ``token``) or
+    GitHub App creds (``app_id`` + ``private_key``, minting a short-lived
+    installation token).  App-token minting needs ``(owner, repo)`` for
+    installation discovery, derived from the project links (an explicit
+    ``installation_id`` credential skips that).  Never raises: the doctor
+    must not hard-fail on a missing or unusable credential, so it degrades
+    to an unauthenticated request, which the caller reports softly.
+    """
+    derived = derive_owner_repo_from_links(
+        ctx.project_links, host, preferred_key=ctx.integration_slug
+    )
+    owner, repo = derived or ('', '')
+    try:
+        return await _resolve_bearer(credentials, api_base, owner, repo)
+    except Exception:  # noqa: BLE001 -- analysis is best-effort
+        LOGGER.warning(
+            'github-doctor: could not resolve a GitHub credential; '
+            'proceeding unauthenticated',
+            exc_info=True,
+        )
+        return None
+
+
 class GitHubDoctor(AnalysisCapability):
     """GitHub project-doctor analysis capability.
 
@@ -189,8 +229,13 @@ class GitHubDoctor(AnalysisCapability):
                     'EXISTS_IN edge',
                     'warn',
                     f'No EXISTS_IN edge found for service {slug!r}. '
-                    'Run the lifecycle plugin to create the repository '
-                    'link and re-index this project.',
+                    'Use the Fix action to create the repository link '
+                    'from GitHub, or run the lifecycle plugin to '
+                    're-index this project.',
+                    RemediationOffer(
+                        id=_REPAIR_EDGE,
+                        label='Create the EXISTS_IN edge from GitHub',
+                    ),
                 )
             ]
 
@@ -204,8 +249,11 @@ class GitHubDoctor(AnalysisCapability):
             )
         )
 
-        # Step 2: build the Bearer token (optional).
-        token = credentials.get('access_token') or credentials.get('token')
+        # Step 2: build the Bearer token (optional).  Accepts both a PAT
+        # and GitHub App creds (minting an installation token), matching
+        # the sync capabilities -- an App-only integration must not be
+        # reported as "no token configured".
+        token = await _resolve_doctor_bearer(credentials, api_base, ctx, host)
         headers: dict[str, str] = {}
         if token:
             headers['Authorization'] = f'Bearer {token}'
@@ -256,9 +304,10 @@ class GitHubDoctor(AnalysisCapability):
             else:
                 status = 'warn'
                 hint = (
-                    'No access token configured; the repository may be '
-                    'private.  Configure an access_token credential to '
-                    'inspect private repositories.'
+                    'No usable GitHub credential was resolved; the '
+                    'repository may be private.  Configure an access_token '
+                    '(PAT) or app_id + private_key (GitHub App) credential '
+                    'to inspect private repositories.'
                 )
             results.append(
                 _item(
@@ -324,7 +373,7 @@ class GitHubDoctor(AnalysisCapability):
         # identifier-type
         try:
             int(connection.identifier)
-        except (ValueError, TypeError):
+        except ValueError, TypeError:
             results.append(
                 _item(
                     'identifier-type',
@@ -506,19 +555,22 @@ class GitHubDoctor(AnalysisCapability):
 
         return results
 
-    async def remediate(
+    async def remediate(  # noqa: C901 — flat sequence of guard clauses
         self,
         ctx: PluginContext,
         credentials: dict[str, str],
         remediation_id: str,
     ) -> RemediationResult:
-        """Repair the EXISTS_IN edge or github-repository link from GitHub.
+        """Create or repair the EXISTS_IN edge / github-repository link.
 
         Re-fetches the repository (the live source of truth) and emits a
         ``ServiceWriteback`` / ``LinkWriteback`` on ``ctx`` for the host
-        to persist.  Idempotent: returns ``noop`` when Imbi already
-        matches GitHub.  A 401 propagates as ``PluginAuthenticationFailed``
-        so the host can refresh the actor's identity and retry once.
+        to persist.  ``_REPAIR_EDGE`` also creates the edge when none
+        exists yet (the host's writeback is an upsert), deriving the repo
+        from the project links.  Idempotent: returns ``noop`` when Imbi
+        already matches GitHub.  A 401 propagates as
+        ``PluginAuthenticationFailed`` so the host can refresh the actor's
+        identity and retry once.
         """
         if remediation_id not in (_REPAIR_EDGE, _REPAIR_GITHUB_LINK):
             return await super().remediate(ctx, credentials, remediation_id)
@@ -529,10 +581,20 @@ class GitHubDoctor(AnalysisCapability):
             return RemediationResult(status='failed', message=str(exc))
         api_base = host_to_api_base(host)
         slug = ctx.integration_slug
-        connection = (
-            _find_connection(ctx.service_connections, slug) if slug else None
-        )
-        if slug is None or connection is None:
+        if slug is None:
+            return RemediationResult(
+                status='failed',
+                message=(
+                    'This plugin is not bound to a service — no EXISTS_IN '
+                    'edge to create or repair.'
+                ),
+            )
+        connection = _find_connection(ctx.service_connections, slug)
+        # ``_REPAIR_EDGE`` creates a missing edge from GitHub, so a
+        # missing connection is only fatal for the github-repository
+        # link repair (which never needs the edge but is only ever
+        # offered once the edge is present).
+        if connection is None and remediation_id == _REPAIR_GITHUB_LINK:
             return RemediationResult(
                 status='failed',
                 message=(
@@ -551,7 +613,7 @@ class GitHubDoctor(AnalysisCapability):
                 ),
             )
 
-        token = credentials.get('access_token') or credentials.get('token')
+        token = await _resolve_doctor_bearer(credentials, api_base, ctx, host)
         headers: dict[str, str] = {}
         if token:
             headers['Authorization'] = f'Bearer {token}'
@@ -613,28 +675,30 @@ class GitHubDoctor(AnalysisCapability):
                 message=f'Set github-repository link to {html_url}.',
             )
 
-        # _REPAIR_EDGE: rewrite identifier + canonical URL + dashboard
-        # link in one ServiceWriteback.
+        # _REPAIR_EDGE: create or rewrite identifier + canonical URL +
+        # dashboard link in one ServiceWriteback.
         desired_canonical = f'{api_base}/repositories/{api_id}'
-        already_correct = (
-            connection.identifier == str(api_id)
-            and connection.canonical_url == desired_canonical
-            and ctx.project_links.get(slug) == html_url
-        )
-        if already_correct:
-            return RemediationResult(
-                status='noop',
-                message='EXISTS_IN edge already matches GitHub.',
+        if connection is not None:
+            already_correct = (
+                connection.identifier == str(api_id)
+                and connection.canonical_url == desired_canonical
+                and ctx.project_links.get(slug) == html_url
             )
+            if already_correct:
+                return RemediationResult(
+                    status='noop',
+                    message='EXISTS_IN edge already matches GitHub.',
+                )
         ctx.service_writeback = ServiceWriteback(
             identifier=str(api_id),
             canonical_url=desired_canonical,
             dashboard_links={slug: html_url},
         )
+        verb = 'Repaired' if connection is not None else 'Created'
         return RemediationResult(
             status='fixed',
             message=(
-                f'Repaired the EXISTS_IN edge for {slug!r} '
+                f'{verb} the EXISTS_IN edge for {slug!r} '
                 f'(identifier={api_id}).'
             ),
         )

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/src/imbi_plugin_github/pull_requests.py

@@ -37,6 +37,7 @@ from imbi_common.plugins.base import (
     PullRequestSyncCapability,
 )
 
+from imbi_plugin_github._app_auth import AppNotInstalledError
 from imbi_plugin_github._hosts import host_to_api_base
 from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.commits import (
@@ -133,6 +134,21 @@ async def _fetch_all_prs(
         resp = await _request(
             client, 'GET', '/pulls', params=params, max_wait=max_wait
         )
+        if resp.status_code == 404:
+            if out:
+                LOGGER.warning(
+                    'github-pr-sync: repository %s returned 404; stopping '
+                    'after %d PRs',
+                    str(client.base_url).rstrip('/'),
+                    len(out),
+                )
+            else:
+                LOGGER.warning(
+                    'github-pr-sync: repository %s returned 404 (renamed '
+                    'or removed); nothing to sync',
+                    str(client.base_url).rstrip('/'),
+                )
+            return out
         resp.raise_for_status()
         page: list[dict[str, typing.Any]] = resp.json()
         if not page:
@@ -301,6 +317,11 @@ class GitHubPullRequestSync(PullRequestSyncCapability):
         Returns the number of PRs recorded.  Raises :class:`ValueError`
         only when the host or repository can't be resolved; ClickHouse
         failures are swallowed (the count reflects what was written).
+        Returns ``0`` (logged as a warning, no error) when the GitHub App
+        is not installed for the repo, or when the first page returns 404
+        (repo renamed/removed); a 404 on a later page stops pagination and
+        returns the PRs collected so far.  Neither condition fails the
+        backfill worker.
         Propagates :class:`PluginRateLimited` when a GitHub rate-limit
         reset is further out than ``_BACKFILL_MAX_WAIT_SECONDS`` so the
         host can pause the worker and keep the job queued until GitHub
@@ -314,7 +335,15 @@ class GitHubPullRequestSync(PullRequestSyncCapability):
             )
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, _SELF_SLUG)
-        token = await _resolve_bearer(credentials, base, owner, repo)
+        try:
+            token = await _resolve_bearer(credentials, base, owner, repo)
+        except AppNotInstalledError as exc:
+            LOGGER.warning(
+                'github-pr-sync: %s; skipping backfill for project %s',
+                exc,
+                ctx.project_id,
+            )
+            return 0
         async with _client(base, owner, repo, token) as client:
             raw_prs = await _fetch_all_prs(
                 client, max_wait=_BACKFILL_MAX_WAIT_SECONDS

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/tests/test_commits.py

@@ -1336,6 +1336,43 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
             )
         self.assertEqual(1, token_route.call_count)
 
+    @respx.mock
+    async def test_app_not_installed_skips(self) -> None:
+        # IMBI-37: a backfill for a repo the GitHub App isn't installed
+        # on must skip cleanly -- return (0, 0), log a warning -- rather
+        # than fail the worker with a Sentry error.
+        _app_auth.reset_cache()
+        self.addCleanup(_app_auth.reset_cache)
+        discovery = respx.get(
+            'https://api.github.com/repos/octo/demo/installation'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        creds = {'app_id': '971', 'private_key': _APP_KEY_PEM}
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(commits.LOGGER, level='WARNING') as cm:
+                result = await commits.GitHubCommitSync().sync_all_history(
+                    ctx=self._ctx(), credentials=creds
+                )
+        self.assertEqual((0, 0), result)
+        self.assertEqual(1, discovery.call_count)
+        insert.assert_not_awaited()
+        self.assertTrue(any('skipping backfill' in x for x in cm.output))
+
+    @respx.mock
+    async def test_app_discovery_non_404_propagates(self) -> None:
+        # A non-404 discovery failure is a real error and must NOT be
+        # swallowed as an app-not-installed skip.
+        _app_auth.reset_cache()
+        self.addCleanup(_app_auth.reset_cache)
+        respx.get('https://api.github.com/repos/octo/demo/installation').mock(
+            return_value=httpx.Response(500, json={'message': 'boom'})
+        )
+        creds = {'app_id': '971', 'private_key': _APP_KEY_PEM}
+        with mock.patch(_INSERT, new=mock.AsyncMock()):
+            with self.assertRaises(httpx.HTTPStatusError):
+                await commits.GitHubCommitSync().sync_all_history(
+                    ctx=self._ctx(), credentials=creds
+                )
+
     @respx.mock
     async def test_annotated_tags_enriched_with_metadata(self) -> None:
         self._mock_default_branch()

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/tests/test_deployment.py

@@ -1,5 +1,6 @@
 """Smoke tests for the GitHub deployment capability handler."""
 
+import asyncio
 import datetime
 import json
 import time
@@ -256,12 +257,15 @@ class ManifestTestCase(unittest.TestCase):
         dep._record_checks_disabled({}, 'github.com', 'octo', 'demo')
         self.assertEqual(dep._CHECKS_DISABLED_TOKENS, original)
 
-    def test_token_required(self) -> None:
+    def test_bearer_requires_credentials(self) -> None:
         with self.assertRaises(ValueError):
-            GitHubDeployment._token({})
+            asyncio.run(GitHubDeployment()._bearer(_ctx(), {}))
 
-    def test_token_accepts_token_alias(self) -> None:
-        self.assertEqual(GitHubDeployment._token({'token': 'abc'}), 'abc')
+    def test_bearer_accepts_token_alias(self) -> None:
+        token = asyncio.run(
+            GitHubDeployment()._bearer(_ctx(), {'token': 'abc'})
+        )
+        self.assertEqual(token, 'abc')
 
     def test_api_base_dot_com(self) -> None:
         plugin = GitHubDeployment()
@@ -851,6 +855,59 @@ class GetDeploymentStatusTestCase(unittest.IsolatedAsyncioTestCase):
 
 
 class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
+    @respx.mock
+    async def test_app_credentials_mint_installation_token(self) -> None:
+        # A service configured with only GitHub App credentials (no acting
+        # user, e.g. the headless deployment-resync sweep) must mint an
+        # installation token and still backfill deployments.
+        from imbi_plugin_github import _app_auth
+        from tests.test_commits import _APP_KEY_PEM, _FAR_FUTURE
+
+        _app_auth.reset_cache()
+        self.addCleanup(_app_auth.reset_cache)
+        token_route = respx.post(
+            'https://api.github.com/app/installations/42/access_tokens'
+        ).mock(
+            return_value=httpx.Response(
+                201, json={'token': 'ghs_minted', 'expires_at': _FAR_FUTURE}
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments',
+            params={'environment': 'production', 'per_page': '1'},
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 7,
+                        'sha': 'appsha',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/7/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(),
+            {
+                'app_id': '971',
+                'private_key': _APP_KEY_PEM,
+                'installation_id': '42',
+            },
+            ['production'],
+        )
+        self.assertTrue(token_route.called)
+        self.assertEqual(len(events), 1)
+        self.assertEqual(events[0].sha, 'appsha')
+
     @respx.mock
     async def test_one_env_one_deployment_success(self) -> None:
         respx.get(
@@ -889,12 +946,18 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
                 ],
             )
         )
+        # ``main`` is a branch, not a release tag -- the release lookup
+        # 404s and ``release_notes`` stays ``None``.
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
         plugin = GitHubDeployment()
         events = await plugin.list_recent_deployments(
             _ctx(), _CREDS, ['infrastructure-testing']
         )
         self.assertEqual(len(events), 1)
         event = events[0]
+        self.assertIsNone(event.release_notes)
         self.assertEqual(event.environment, 'infrastructure-testing')
         self.assertEqual(event.sha, '2668cd0abc')
         self.assertEqual(event.ref, 'main')
@@ -960,6 +1023,12 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(
             'https://api.github.com/repos/octo/demo/deployments/2/statuses'
         ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.0.0'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
         plugin = GitHubDeployment()
         events = await plugin.list_recent_deployments(
             _ctx(), _CREDS, ['production', 'staging']
@@ -1106,6 +1175,128 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
         )
         self.assertEqual([e.external_run_id for e in events], ['11'])
 
+    @respx.mock
+    async def test_release_notes_populated_for_tag_ref(self) -> None:
+        # A deployment against a release tag carries the release body so
+        # the host can persist it as the Release node's notes.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 42,
+                        'sha': 'relsha',
+                        'ref': '5.9.0',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/42/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/5.9.0'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'tag_name': '5.9.0',
+                    'body': "## What's Changed\n- Migrated to servicelib",
+                    'published_at': '2026-05-13T13:55:00Z',
+                },
+            )
+        )
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(
+            events[0].release_notes,
+            "## What's Changed\n- Migrated to servicelib",
+        )
+
+    @respx.mock
+    async def test_release_notes_none_when_body_empty(self) -> None:
+        # A release with an empty body yields ``None`` rather than an
+        # empty string, matching the "no notes" host semantics.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 43,
+                        'sha': 'relsha2',
+                        'ref': '6.0.0',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/43/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/6.0.0'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'tag_name': '6.0.0', 'body': ''}
+            )
+        )
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertIsNone(events[0].release_notes)
+
+    @respx.mock
+    async def test_release_notes_403_suppresses_further_lookups(self) -> None:
+        # A token that can't read releases 403s once; the process-wide
+        # cache then short-circuits subsequent lookups (same repo+token)
+        # so resync doesn't re-issue the failing request per deployment.
+        from imbi_plugin_github.deployment import _RELEASES_FORBIDDEN_TOKENS
+
+        _RELEASES_FORBIDDEN_TOKENS.clear()
+        self.addCleanup(_RELEASES_FORBIDDEN_TOKENS.clear)
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 51,
+                        'sha': 'sha1',
+                        'ref': 'v1.0.0',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    },
+                    {
+                        'id': 52,
+                        'sha': 'sha2',
+                        'ref': 'v2.0.0',
+                        'created_at': '2026-05-13T14:05:00Z',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/51/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/52/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        # Only the first release lookup is mocked (403).  The second
+        # (v2.0.0) is deliberately left unmocked: if the 403 weren't
+        # cached, resync would issue it and respx would raise.
+        first = respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v1.0.0'
+        ).mock(return_value=httpx.Response(403, json={'message': 'Forbidden'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production'], limit=2
+        )
+        self.assertEqual(len(events), 2)
+        self.assertTrue(all(e.release_notes is None for e in events))
+        self.assertEqual(first.call_count, 1)
+
 
 class CheckStatusTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/tests/test_doctor.py

@@ -4,6 +4,8 @@ import unittest
 
 import httpx
 import respx
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from imbi_common.plugins.base import (
     AnalysisResultItem,
     PluginContext,
@@ -14,6 +16,7 @@ from imbi_common.plugins.errors import (
     PluginRemediationNotSupported,
 )
 
+from imbi_plugin_github import _app_auth
 from imbi_plugin_github.doctor import (
     _REPAIR_EDGE,
     _REPAIR_GITHUB_LINK,
@@ -30,6 +33,20 @@ _TPS_SLUG = 'aweber-github'
 _CREDS = {'access_token': 'gho_test'}
 
 
+def _gen_pem() -> str:
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    ).decode()
+
+
+# Generated once for the module; signing only needs a valid RSA key.
+_APP_KEY_PEM = _gen_pem()
+_FAR_FUTURE = '2099-01-01T00:00:00Z'
+
+
 def _ctx(
     *,
     service_slug: str | None = _TPS_SLUG,
@@ -98,6 +115,11 @@ class AnalyzeTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(len(results), 1)
         self.assertEqual(results[0].slug, 'exists-in')
         self.assertEqual(results[0].status, 'warn')
+        # The no-edge warning offers a Fix action to create the edge.
+        offer = results[0].remediation
+        self.assertIsNotNone(offer)
+        assert offer is not None
+        self.assertEqual(offer.id, _REPAIR_EDGE)
 
     async def test_warns_when_no_integration_flavor(self) -> None:
         # Without a valid integration flavor the host cannot be resolved.
@@ -107,6 +129,11 @@ class AnalyzeTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(results[0].slug, 'connection')
         self.assertEqual(results[0].status, 'warn')
 
+    def tearDown(self) -> None:
+        # App installation tokens are cached process-wide; reset so an
+        # App-cred test doesn't leak a minted token into later tests.
+        _app_auth.reset_cache()
+
     @respx.mock
     async def test_happy_path(self) -> None:
         respx.get(_CANONICAL).mock(
@@ -313,6 +340,37 @@ class AnalyzeTestCase(unittest.IsolatedAsyncioTestCase):
         results = await plugin.analyze(_ctx(), _CREDS)
         self.assertEqual(_by_slug(results)['canonical-url'].status, 'fail')
 
+    @respx.mock
+    async def test_app_credentials_mint_token_for_analysis(self) -> None:
+        # An App-only integration (app_id + private_key) must analyze
+        # successfully by minting an installation token via the sync
+        # path's resolver -- not warn "no token configured".
+        token_route = respx.post(
+            'https://api.aweber.ghe.com/app/installations/55/access_tokens'
+        ).mock(
+            return_value=httpx.Response(
+                201, json={'token': 'ghs_minted', 'expires_at': _FAR_FUTURE}
+            )
+        )
+        repo_route = respx.get(_CANONICAL).mock(
+            return_value=httpx.Response(200, json=_REPO_PAYLOAD)
+        )
+        plugin = GitHubDoctor()
+        results = await plugin.analyze(
+            _ctx(),
+            {
+                'app_id': '971',
+                'private_key': _APP_KEY_PEM,
+                'installation_id': '55',
+            },
+        )
+        self.assertEqual(_by_slug(results)['canonical-url'].status, 'pass')
+        self.assertEqual(token_route.call_count, 1)
+        self.assertEqual(
+            'Bearer ghs_minted',
+            repo_route.calls.last.request.headers['authorization'],
+        )
+
     @respx.mock
     async def test_canonical_fetch_404(self) -> None:
         respx.get(_CANONICAL).mock(return_value=httpx.Response(404))
@@ -407,10 +465,45 @@ class RemediateTestCase(unittest.IsolatedAsyncioTestCase):
         with self.assertRaises(PluginRemediationNotSupported):
             await plugin.remediate(_ctx(), _CREDS, 'bogus')
 
-    async def test_no_connection_failed(self) -> None:
+    async def test_no_service_binding_failed(self) -> None:
+        plugin = GitHubDoctor()
+        result = await plugin.remediate(
+            _ctx(service_slug=None), _CREDS, _REPAIR_EDGE
+        )
+        self.assertEqual(result.status, 'failed')
+
+    async def test_github_link_repair_no_connection_failed(self) -> None:
+        # The github-repository link repair still requires an edge.
+        plugin = GitHubDoctor()
+        result = await plugin.remediate(
+            _ctx(connections=[]), _CREDS, _REPAIR_GITHUB_LINK
+        )
+        self.assertEqual(result.status, 'failed')
+
+    @respx.mock
+    async def test_edge_create_when_no_connection(self) -> None:
+        # No EXISTS_IN edge yet: the repo is resolved from the project
+        # links and a ServiceWriteback is emitted to create the edge.
+        repo_url = f'{_API_BASE}/repos/aweber/demo'
+        respx.get(repo_url).mock(
+            return_value=httpx.Response(200, json=_REPO_PAYLOAD)
+        )
+        plugin = GitHubDoctor()
+        ctx = _ctx(connections=[])
+        result = await plugin.remediate(ctx, _CREDS, _REPAIR_EDGE)
+        self.assertEqual(result.status, 'fixed')
+        assert ctx.service_writeback is not None
+        self.assertEqual(ctx.service_writeback.identifier, '134741')
+        self.assertEqual(ctx.service_writeback.canonical_url, _CANONICAL)
+        self.assertEqual(
+            ctx.service_writeback.dashboard_links, {_TPS_SLUG: _DASHBOARD}
+        )
+
+    async def test_edge_create_unresolvable_repo_failed(self) -> None:
+        # No edge and no resolvable link -> cannot determine the repo.
         plugin = GitHubDoctor()
         result = await plugin.remediate(
-            _ctx(connections=[]), _CREDS, _REPAIR_EDGE
+            _ctx(connections=[], links={}), _CREDS, _REPAIR_EDGE
         )
         self.assertEqual(result.status, 'failed')
 

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/tests/test_pull_requests.py

@@ -6,13 +6,28 @@ from unittest import mock
 
 import httpx
 import respx
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from imbi_common.plugins.base import PluginContext
 
-from imbi_plugin_github import pull_requests
+from imbi_plugin_github import _app_auth, pull_requests
 from imbi_plugin_github.plugin import GitHubPlugin, GitHubWebhookActions
 
 _CREDS = {'access_token': 'gho_test'}
 _REPO = 'https://api.github.com/repos/octo/demo'
+
+
+def _gen_pem() -> str:
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    ).decode()
+
+
+# Generated once for the module; signing only needs a valid RSA key.
+_APP_KEY_PEM = _gen_pem()
 # ``sync_all_history`` inserts through ``_insert_best_effort`` (defined in
 # commits.py), so its ClickHouse call resolves in the commits namespace.
 _INSERT_BACKFILL = 'imbi_plugin_github.commits.clickhouse.insert'
@@ -153,6 +168,86 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
                 ctx=_ctx(connection={}), credentials=_CREDS
             )
 
+    @respx.mock
+    async def test_repo_gone_404_skips(self) -> None:
+        # IMBI-36: a renamed/removed repo returns 404 on the pulls list;
+        # the backfill must skip cleanly (return 0, log a warning) so the
+        # worker doesn't emit a Sentry error.
+        pulls = respx.get(f'{_REPO}/pulls').mock(
+            return_value=httpx.Response(404, json={'message': 'Not Found'})
+        )
+        handler = pull_requests.GitHubPullRequestSync()
+        with mock.patch(_INSERT_BACKFILL, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(pull_requests.LOGGER, level='WARNING') as cm:
+                count = await handler.sync_all_history(
+                    ctx=_ctx(), credentials=_CREDS
+                )
+        self.assertEqual(count, 0)
+        self.assertEqual(1, pulls.call_count)
+        insert.assert_not_awaited()
+        self.assertTrue(any('nothing to sync' in x for x in cm.output))
+
+    @respx.mock
+    async def test_later_page_404_keeps_partial(self) -> None:
+        # A 404 on a later page (not the first) stops pagination but keeps
+        # the PRs already collected; the count and warning must reflect the
+        # partial result rather than claiming "nothing to sync".
+        link = f'<{_REPO}/pulls?page=2>; rel="next"'
+        pulls = respx.get(f'{_REPO}/pulls').mock(
+            side_effect=[
+                httpx.Response(
+                    200,
+                    json=[_pr(id=1, number=1)],
+                    headers={'link': link},
+                ),
+                httpx.Response(404, json={'message': 'Not Found'}),
+            ]
+        )
+        handler = pull_requests.GitHubPullRequestSync()
+        with mock.patch(_INSERT_BACKFILL, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(pull_requests.LOGGER, level='WARNING') as cm:
+                count = await handler.sync_all_history(
+                    ctx=_ctx(), credentials=_CREDS
+                )
+        self.assertEqual(count, 1)
+        self.assertEqual(2, pulls.call_count)
+        insert.assert_awaited_once()
+        self.assertTrue(any('stopping after 1 PRs' in x for x in cm.output))
+
+    @respx.mock
+    async def test_pulls_non_404_propagates(self) -> None:
+        # A non-404 failure on the pulls list is a real error and must
+        # still propagate rather than be swallowed as "repo gone".
+        respx.get(f'{_REPO}/pulls').mock(
+            return_value=httpx.Response(500, json={'message': 'boom'})
+        )
+        with mock.patch(_INSERT_BACKFILL, new=mock.AsyncMock()):
+            with self.assertRaises(httpx.HTTPStatusError):
+                await pull_requests.GitHubPullRequestSync().sync_all_history(
+                    ctx=_ctx(), credentials=_CREDS
+                )
+
+    @respx.mock
+    async def test_app_not_installed_skips(self) -> None:
+        # IMBI-37: the shared GitHub App discovery 404s when the App is
+        # not installed for the repo; the backfill must skip cleanly.
+        _app_auth.reset_cache()
+        self.addCleanup(_app_auth.reset_cache)
+        discovery = respx.get(f'{_REPO}/installation').mock(
+            return_value=httpx.Response(404, json={'message': 'Not Found'})
+        )
+        creds = {'app_id': '971', 'private_key': _APP_KEY_PEM}
+        handler = pull_requests.GitHubPullRequestSync()
+        with mock.patch(_INSERT_BACKFILL, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(pull_requests.LOGGER, level='WARNING') as cm:
+                count = await handler.sync_all_history(
+                    ctx=_ctx(), credentials=creds
+                )
+        self.assertEqual(count, 0)
+        self.assertEqual(1, discovery.call_count)
+        insert.assert_not_awaited()
+        self.assertTrue(any('skipping backfill' in x for x in cm.output))
+
 
 class CheckAvailableTestCase(unittest.IsolatedAsyncioTestCase):
     async def test_available_with_host_and_repo(self) -> None:

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.0}/uv.lock

@@ -667,7 +667,7 @@ wheels = [
 
 [[package]]
 name = "imbi-common"
-version = "2.13.3"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
@@ -683,9 +683,9 @@ dependencies = [
     { name = "python-slugify" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9c/c0/b763c967428c8a804046a62d52bba1e61121193fff526484906383bb9bce/imbi_common-2.13.3.tar.gz", hash = "sha256:76de3f2a1d2191275e3fa4ef2370484b61bd4ad5dff50eb996dd63539f72010e", size = 360800, upload-time = "2026-07-15T14:55:53.31Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/4c/c8837aef3cbbb5e886ce51085f0bd4c315fcc8b0325fc6060b6167e25296/imbi_common-2.14.0.tar.gz", hash = "sha256:b0a8d2168e72892a51df9054ae90b4f9e1ba668a490d673c7e9077996f8635f3", size = 361115, upload-time = "2026-07-15T21:52:14.795Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/35/07/5c9274570493763e570f0e10a5dee627f958cc60b60fbf2df081c6a97795/imbi_common-2.13.3-py3-none-any.whl", hash = "sha256:d073a53080e6b9f1c8d895b23b30f4cd03da8e8f359cccc77b6230c639d072c7", size = 120605, upload-time = "2026-07-15T14:55:51.732Z" },
+    { url = "https://files.pythonhosted.org/packages/af/17/32614176cb1772f0c973d313d2d82f43d11e6892817c868e75b9b269323c/imbi_common-2.14.0-py3-none-any.whl", hash = "sha256:34e1b05e8e165aed8e7fc61fdd2ddbbaff55f733de58ce5de4174d7bb4f93647", size = 120818, upload-time = "2026-07-15T21:52:13.461Z" },
 ]
 
 [package.optional-dependencies]
@@ -703,7 +703,7 @@ server = [
 
 [[package]]
 name = "imbi-plugin-github"
-version = "2.13.3"
+version = "2.14.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -732,7 +732,7 @@ dist = [
 [package.metadata]
 requires-dist = [
     { name = "httpx", specifier = ">=0.27" },
-    { name = "imbi-common", extras = ["databases"], specifier = "==2.13.3" },
+    { name = "imbi-common", extras = ["databases"], specifier = "==2.14.0" },
     { name = "pydantic", specifier = ">=2" },
     { name = "pyjwt", extras = ["crypto"], specifier = ">=2.8" },
 ]
@@ -741,7 +741,7 @@ requires-dist = [
 dev = [
     { name = "basedpyright" },
     { name = "coverage", extras = ["toml"] },
-    { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.13.3" },
+    { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.14.0" },
     { name = "pre-commit" },
     { name = "pytest" },
     { name = "pytest-asyncio" },