imbi-plugin-github 2.13.3__tar.gz → 2.14.1__tar.gz

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.13.3
+Version: 2.14.1
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.13.3
+Requires-Dist: imbi-common[databases]==2.14.1
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.13.3"
+version = "2.14.1"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,7 +16,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.13.3",
+  "imbi-common[databases]==2.14.1",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]
@@ -25,7 +25,7 @@ dependencies = [
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.13.3",
+  "imbi-common[server,databases]==2.14.1",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/src/imbi_plugin_github/_app_auth.py

@@ -33,6 +33,18 @@ from imbi_plugin_github.deployment import (
 
 LOGGER = logging.getLogger(__name__)
 
+
+class AppNotInstalledError(Exception):
+    """The GitHub App is not installed for the target repository.
+
+    Raised by :func:`_discover_installation_id` when GitHub answers the
+    installation lookup with a 404 -- the App has not been installed on
+    the repo/org, or the repo was renamed/removed.  Sync callers treat
+    this as a clean skip rather than a hard failure, so an uninstalled
+    App never surfaces as a Sentry error on a backfill worker.
+    """
+
+
 _HTTP_TIMEOUT_SECONDS = 10.0
 # GitHub rejects an App JWT whose ``exp`` is more than 10 minutes out;
 # sign for 9 to leave room for clock skew between us and GitHub.
@@ -114,11 +126,15 @@ async def _discover_installation_id(
     client: httpx.AsyncClient, owner: str, repo: str
 ) -> str:
     resp = await client.get(f'/repos/{owner}/{repo}/installation')
+    if resp.status_code == 404:
+        raise AppNotInstalledError(
+            f'no GitHub App installation found for {owner}/{repo}'
+        )
     resp.raise_for_status()
     data = typing.cast('dict[str, typing.Any]', resp.json())
     install_id = data.get('id')
     if install_id is None:
-        raise ValueError(
+        raise AppNotInstalledError(
             f'no GitHub App installation found for {owner}/{repo}'
         )
     return str(install_id)
@@ -193,3 +209,37 @@ async def installation_token(
         _token_deadline(expires_at),
     )
     return token
+
+
+async def resolve_bearer(
+    credentials: dict[str, str], base: str, owner: str, repo: str
+) -> str:
+    """Resolve the Bearer token used for a repo's GitHub API calls.
+
+    Prefers an explicit PAT (``access_token``/``token``).  Otherwise mints
+    a short-lived GitHub App installation token from ``app_id`` +
+    ``private_key`` (with an optional ``installation_id`` that skips
+    per-repo installation discovery).  Tokens are cached process-wide.
+
+    Shared by every host-agnostic behavioral plugin (commit-sync,
+    pr-sync, deployment) so a service configured with only App
+    credentials -- and therefore no acting user -- can still act.
+    """
+    token = credentials.get('access_token') or credentials.get('token')
+    if token:
+        return token
+    app_id = credentials.get('app_id')
+    private_key = credentials.get('private_key')
+    if app_id and private_key:
+        return await installation_token(
+            base=base,
+            app_id=app_id,
+            private_key=private_key,
+            installation_id=credentials.get('installation_id') or None,
+            owner=owner,
+            repo=repo,
+        )
+    raise ValueError(
+        'GitHub plugin requires either an access_token (PAT) or '
+        'app_id + private_key (GitHub App) credentials'
+    )

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/src/imbi_plugin_github/commits.py

@@ -254,30 +254,11 @@ async def _resolve_bearer(
 ) -> str:
     """Resolve the Bearer token used for the repo's GitHub API calls.
 
-    Prefers an explicit PAT (``access_token``/``token``).  Otherwise
-    mints a short-lived GitHub App installation token from ``app_id`` +
-    ``private_key`` (with an optional ``installation_id`` that skips
-    per-repo installation discovery).  Tokens are cached process-wide by
-    :mod:`imbi_plugin_github._app_auth`.
+    Thin wrapper over :func:`imbi_plugin_github._app_auth.resolve_bearer`
+    (the single source of truth), kept as a module-local name for the
+    commit-sync call sites and tests.
     """
-    token = credentials.get('access_token') or credentials.get('token')
-    if token:
-        return token
-    app_id = credentials.get('app_id')
-    private_key = credentials.get('private_key')
-    if app_id and private_key:
-        return await _app_auth.installation_token(
-            base=base,
-            app_id=app_id,
-            private_key=private_key,
-            installation_id=credentials.get('installation_id') or None,
-            owner=owner,
-            repo=repo,
-        )
-    raise ValueError(
-        'github-commit-sync requires either an access_token (PAT) or '
-        'app_id + private_key (GitHub App) credentials'
-    )
+    return await _app_auth.resolve_bearer(credentials, base, owner, repo)
 
 
 def _resolve(pointer: jsonpointer.JsonPointer, event: object) -> object:
@@ -1273,7 +1254,10 @@ class GitHubCommitSync(CommitSyncCapability):
         Returns ``(commits_recorded, tags_recorded)``.  Raises
         :class:`ValueError` only when the host or repository can't be
         resolved; ClickHouse failures are swallowed (the count reflects
-        what was written).  Propagates :class:`PluginRateLimited` when a
+        what was written).  Returns ``(0, 0)`` (logged as a warning, no
+        error) when the GitHub App is not installed for the repo, so an
+        uninstalled App never fails the backfill worker.  Propagates
+        :class:`PluginRateLimited` when a
         GitHub rate-limit reset is further out than
         ``_BACKFILL_MAX_WAIT_SECONDS`` so the host can pause the worker and
         keep the job queued until GitHub resumes rather than fail it.
@@ -1287,7 +1271,15 @@ class GitHubCommitSync(CommitSyncCapability):
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')
         pushed_at = datetime.datetime.now(datetime.UTC)
-        token = await _resolve_bearer(credentials, base, owner, repo)
+        try:
+            token = await _resolve_bearer(credentials, base, owner, repo)
+        except _app_auth.AppNotInstalledError as exc:
+            LOGGER.warning(
+                'github-commit-sync: %s; skipping backfill for project %s',
+                exc,
+                ctx.project_id,
+            )
+            return 0, 0
         async with _client(base, owner, repo, token) as client:
             branch = await _fetch_default_branch(
                 client, max_wait=_BACKFILL_MAX_WAIT_SECONDS

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/src/imbi_plugin_github/deployment.py

@@ -236,6 +236,49 @@ def _record_checks_disabled(
     _CHECKS_DISABLED_TOKENS[key] = now
 
 
+# Process-wide 403 suppression for release-notes lookups, mirroring the
+# check-runs cache above: a token that lacks the scope to read releases
+# must not re-issue ``GET /releases/tags/{ref}`` for every deployment on
+# every resync sweep.  Keyed by a hash of the repo-scoped client's base
+# URL (host + ``owner/repo``) plus its bearer header (the token), so a
+# single forbidden repo doesn't suppress release reads elsewhere.
+_RELEASES_FORBIDDEN_TOKENS: dict[str, float] = {}
+
+
+def _releases_cache_key(client: httpx.AsyncClient) -> str:
+    material = f'{client.base_url}\n{client.headers.get("authorization", "")}'
+    return hashlib.sha256(material.encode()).hexdigest()
+
+
+def _releases_forbidden(client: httpx.AsyncClient) -> bool:
+    """Whether this client's token has recently 403'd on releases."""
+    key = _releases_cache_key(client)
+    recorded = _RELEASES_FORBIDDEN_TOKENS.get(key)
+    if recorded is None:
+        return False
+    if time.monotonic() - recorded > _CHECKS_DISABLED_TTL_SECONDS:
+        _RELEASES_FORBIDDEN_TOKENS.pop(key, None)
+        return False
+    return True
+
+
+def _record_releases_forbidden(client: httpx.AsyncClient) -> None:
+    """Mark this client's token as forbidden from releases for the TTL.
+
+    Opportunistically evicts expired entries so the dict can't grow
+    unbounded, mirroring :func:`_record_checks_disabled`.
+    """
+    now = time.monotonic()
+    expired = [
+        k
+        for k, recorded in _RELEASES_FORBIDDEN_TOKENS.items()
+        if now - recorded > _CHECKS_DISABLED_TTL_SECONDS
+    ]
+    for k in expired:
+        _RELEASES_FORBIDDEN_TOKENS.pop(k, None)
+    _RELEASES_FORBIDDEN_TOKENS[_releases_cache_key(client)] = now
+
+
 def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     """Convert a GitHub commit list/object payload into a :class:`Commit`."""
     sha = str(payload.get('sha', ''))
@@ -322,15 +365,25 @@ class GitHubDeployment(DeploymentCapability):
             return value.strip()
         return default
 
-    @staticmethod
-    def _token(credentials: dict[str, str]) -> str:
-        token = credentials.get('access_token') or credentials.get('token')
-        if not token:
-            raise ValueError(
-                'GitHub deployment plugin requires an OAuth access token; '
-                'expected ``credentials["access_token"]``'
-            )
-        return token
+    async def _bearer(
+        self, ctx: PluginContext, credentials: dict[str, str]
+    ) -> str:
+        """Resolve the Bearer token for this deployment call.
+
+        Prefers the per-user OAuth token the host threads in as
+        ``access_token``; when a service configured with only GitHub App
+        credentials drives the call (e.g. the headless deployment-resync
+        sweep, which has no acting user), mints an installation token
+        from ``app_id`` + ``private_key`` instead.
+        """
+        # Local import: ``_app_auth`` imports this module for its shared
+        # HTTP helpers, so a top-level import here would be circular.
+        from imbi_plugin_github import _app_auth
+
+        owner, repo = self._owner_repo(ctx)
+        return await _app_auth.resolve_bearer(
+            credentials, self._api_base(ctx), owner, repo
+        )
 
     @contextlib.asynccontextmanager
     async def _client(
@@ -358,7 +411,7 @@ class GitHubDeployment(DeploymentCapability):
 
         client = httpx.AsyncClient(
             timeout=_HTTP_TIMEOUT_SECONDS,
-            headers=_auth_headers(self._token(credentials)),
+            headers=_auth_headers(await self._bearer(ctx, credentials)),
             base_url=self._repo_url(ctx),
             follow_redirects=True,
             event_hooks={'response': [_capture_redirect, _raise_on_401]},
@@ -388,7 +441,7 @@ class GitHubDeployment(DeploymentCapability):
             return
         try:
             resp = await client.get(repo_root)
-        except (httpx.HTTPError, PluginAuthenticationFailed):
+        except httpx.HTTPError, PluginAuthenticationFailed:
             # The user-facing request already succeeded; a probe failure
             # (network, or a 401 surfaced by the response hook) must not
             # turn that success into an error during teardown.
@@ -958,6 +1011,25 @@ class GitHubDeployment(DeploymentCapability):
             )
         return [observed for group in per_env for observed in group]
 
+    async def get_release_notes(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        tag: str,
+    ) -> str | None:
+        """Return the GitHub release body for ``tag``.
+
+        Tag-keyed enrichment path: the host calls this when it knows the
+        release tag but not its notes -- a webhook that created the
+        ``Release`` node from a deployment event (whose payload carries no
+        body), or a resync whose deployment ``ref`` was a raw SHA.  Opens
+        a repo-scoped client and defers to :meth:`_release_notes_for_ref`,
+        which 404s to ``None`` for tags without a release and caches 403s
+        so a scope-limited token short-circuits.
+        """
+        async with self._client(ctx, credentials) as client:
+            return await self._release_notes_for_ref(client, tag)
+
     async def _list_deployments_for_env(
         self,
         client: httpx.AsyncClient,
@@ -1022,6 +1094,11 @@ class GitHubDeployment(DeploymentCapability):
         )
         ref_value = deployment.get('ref')
         description = deployment.get('description')
+        release_notes = (
+            await self._release_notes_for_ref(client, str(ref_value))
+            if ref_value
+            else None
+        )
         deployment_url = deployment.get('url') or deployment.get('html_url')
         creator_login: str | None = None
         creator_subject: str | None = None
@@ -1046,10 +1123,45 @@ class GitHubDeployment(DeploymentCapability):
             run_url=status_url,
             deployment_url=str(deployment_url) if deployment_url else None,
             description=str(description) if description else None,
+            release_notes=release_notes,
             creator=creator_login,
             creator_subject=creator_subject,
         )
 
+    async def _release_notes_for_ref(
+        self, client: httpx.AsyncClient, ref: str
+    ) -> str | None:
+        """Return the GitHub release notes body for a deployed ref.
+
+        A deployment created against a semver tag has a matching GitHub
+        release whose ``body`` is the "What's Changed" markdown the host
+        persists on the ``Release`` node.  Refs that aren't a release tag
+        (branches, raw SHAs) 404 here and yield ``None`` -- resync is
+        never blocked by a missing or unreadable release.  A ``403``
+        (token lacks scope to read releases) is cached process-wide so a
+        forbidden token short-circuits instead of re-issuing the request
+        for every deployment on every resync sweep.
+        """
+        if _releases_forbidden(client):
+            return None
+        try:
+            resp = await client.get(
+                f'/releases/tags/{urllib.parse.quote(ref, safe="")}'
+            )
+        except httpx.HTTPError:
+            return None
+        if resp.status_code == 403:
+            _record_releases_forbidden(client)
+            return None
+        if resp.status_code != 200:
+            return None
+        try:
+            data = typing.cast(dict[str, typing.Any], resp.json())
+        except ValueError:
+            return None
+        body = data.get('body')
+        return str(body) if body else None
+
     async def _latest_status(
         self, client: httpx.AsyncClient, deployment_id: str
     ) -> tuple[DeploymentEventStatus, str | None]:

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/src/imbi_plugin_github/doctor.py

@@ -15,6 +15,7 @@ its own.
 
 from __future__ import annotations
 
+import logging
 import re
 import typing
 
@@ -37,6 +38,11 @@ from imbi_plugin_github._hosts import (
     host_to_api_base,
 )
 from imbi_plugin_github._repos import derive_owner_repo_from_links
+from imbi_plugin_github.commits import (
+    _resolve_bearer,  # pyright: ignore[reportPrivateUsage]
+)
+
+LOGGER = logging.getLogger(__name__)
 
 _TIMEOUT = 15.0
 # Matches the canonical URL shape written by the lifecycle plugin:
@@ -100,7 +106,7 @@ def _item(
 
 
 def _repo_fetch_url(
-    connection: ServiceConnection,
+    connection: ServiceConnection | None,
     ctx: PluginContext,
     host: str,
     api_base: str,
@@ -109,7 +115,9 @@ def _repo_fetch_url(
 
     Prefer the rename-stable canonical URL on the ``EXISTS_IN`` edge;
     otherwise derive ``(owner, repo)`` from the project links. Returns
-    ``None`` when neither is available.
+    ``None`` when neither is available. ``connection`` is ``None`` when
+    no ``EXISTS_IN`` edge exists yet (the create-edge remediation), in
+    which case the URL is derived from the project links alone.
 
     The stored canonical URL is never fetched verbatim: only the numeric
     repository id is trusted from it, and the request URL is rebuilt
@@ -117,7 +125,7 @@ def _repo_fetch_url(
     truth). This keeps the Bearer token from ever being sent to an
     arbitrary host smuggled onto the ``EXISTS_IN`` edge.
     """
-    if connection.canonical_url:
+    if connection is not None and connection.canonical_url:
         match = _REPO_ID_RE.fullmatch(connection.canonical_url)
         if match is not None:
             return f'{api_base}/repositories/{match.group(1)}'
@@ -147,6 +155,38 @@ def _find_connection(
     )
 
 
+async def _resolve_doctor_bearer(
+    credentials: dict[str, str],
+    api_base: str,
+    ctx: PluginContext,
+    host: str,
+) -> str | None:
+    """Resolve a Bearer token for analysis / remediation, or ``None``.
+
+    Accepts the same credential shapes as the sync capabilities via
+    :func:`_resolve_bearer` — a PAT (``access_token`` / ``token``) or
+    GitHub App creds (``app_id`` + ``private_key``, minting a short-lived
+    installation token).  App-token minting needs ``(owner, repo)`` for
+    installation discovery, derived from the project links (an explicit
+    ``installation_id`` credential skips that).  Never raises: the doctor
+    must not hard-fail on a missing or unusable credential, so it degrades
+    to an unauthenticated request, which the caller reports softly.
+    """
+    derived = derive_owner_repo_from_links(
+        ctx.project_links, host, preferred_key=ctx.integration_slug
+    )
+    owner, repo = derived or ('', '')
+    try:
+        return await _resolve_bearer(credentials, api_base, owner, repo)
+    except Exception:  # noqa: BLE001 -- analysis is best-effort
+        LOGGER.warning(
+            'github-doctor: could not resolve a GitHub credential; '
+            'proceeding unauthenticated',
+            exc_info=True,
+        )
+        return None
+
+
 class GitHubDoctor(AnalysisCapability):
     """GitHub project-doctor analysis capability.
 
@@ -189,8 +229,13 @@ class GitHubDoctor(AnalysisCapability):
                     'EXISTS_IN edge',
                     'warn',
                     f'No EXISTS_IN edge found for service {slug!r}. '
-                    'Run the lifecycle plugin to create the repository '
-                    'link and re-index this project.',
+                    'Use the Fix action to create the repository link '
+                    'from GitHub, or run the lifecycle plugin to '
+                    're-index this project.',
+                    RemediationOffer(
+                        id=_REPAIR_EDGE,
+                        label='Create the EXISTS_IN edge from GitHub',
+                    ),
                 )
             ]
 
@@ -204,8 +249,11 @@ class GitHubDoctor(AnalysisCapability):
             )
         )
 
-        # Step 2: build the Bearer token (optional).
-        token = credentials.get('access_token') or credentials.get('token')
+        # Step 2: build the Bearer token (optional).  Accepts both a PAT
+        # and GitHub App creds (minting an installation token), matching
+        # the sync capabilities -- an App-only integration must not be
+        # reported as "no token configured".
+        token = await _resolve_doctor_bearer(credentials, api_base, ctx, host)
         headers: dict[str, str] = {}
         if token:
             headers['Authorization'] = f'Bearer {token}'
@@ -256,9 +304,10 @@ class GitHubDoctor(AnalysisCapability):
             else:
                 status = 'warn'
                 hint = (
-                    'No access token configured; the repository may be '
-                    'private.  Configure an access_token credential to '
-                    'inspect private repositories.'
+                    'No usable GitHub credential was resolved; the '
+                    'repository may be private.  Configure an access_token '
+                    '(PAT) or app_id + private_key (GitHub App) credential '
+                    'to inspect private repositories.'
                 )
             results.append(
                 _item(
@@ -324,7 +373,7 @@ class GitHubDoctor(AnalysisCapability):
         # identifier-type
         try:
             int(connection.identifier)
-        except (ValueError, TypeError):
+        except ValueError, TypeError:
             results.append(
                 _item(
                     'identifier-type',
@@ -506,19 +555,22 @@ class GitHubDoctor(AnalysisCapability):
 
         return results
 
-    async def remediate(
+    async def remediate(  # noqa: C901 — flat sequence of guard clauses
         self,
         ctx: PluginContext,
         credentials: dict[str, str],
         remediation_id: str,
     ) -> RemediationResult:
-        """Repair the EXISTS_IN edge or github-repository link from GitHub.
+        """Create or repair the EXISTS_IN edge / github-repository link.
 
         Re-fetches the repository (the live source of truth) and emits a
         ``ServiceWriteback`` / ``LinkWriteback`` on ``ctx`` for the host
-        to persist.  Idempotent: returns ``noop`` when Imbi already
-        matches GitHub.  A 401 propagates as ``PluginAuthenticationFailed``
-        so the host can refresh the actor's identity and retry once.
+        to persist.  ``_REPAIR_EDGE`` also creates the edge when none
+        exists yet (the host's writeback is an upsert), deriving the repo
+        from the project links.  Idempotent: returns ``noop`` when Imbi
+        already matches GitHub.  A 401 propagates as
+        ``PluginAuthenticationFailed`` so the host can refresh the actor's
+        identity and retry once.
         """
         if remediation_id not in (_REPAIR_EDGE, _REPAIR_GITHUB_LINK):
             return await super().remediate(ctx, credentials, remediation_id)
@@ -529,10 +581,20 @@ class GitHubDoctor(AnalysisCapability):
             return RemediationResult(status='failed', message=str(exc))
         api_base = host_to_api_base(host)
         slug = ctx.integration_slug
-        connection = (
-            _find_connection(ctx.service_connections, slug) if slug else None
-        )
-        if slug is None or connection is None:
+        if slug is None:
+            return RemediationResult(
+                status='failed',
+                message=(
+                    'This plugin is not bound to a service — no EXISTS_IN '
+                    'edge to create or repair.'
+                ),
+            )
+        connection = _find_connection(ctx.service_connections, slug)
+        # ``_REPAIR_EDGE`` creates a missing edge from GitHub, so a
+        # missing connection is only fatal for the github-repository
+        # link repair (which never needs the edge but is only ever
+        # offered once the edge is present).
+        if connection is None and remediation_id == _REPAIR_GITHUB_LINK:
             return RemediationResult(
                 status='failed',
                 message=(
@@ -551,7 +613,7 @@ class GitHubDoctor(AnalysisCapability):
                 ),
             )
 
-        token = credentials.get('access_token') or credentials.get('token')
+        token = await _resolve_doctor_bearer(credentials, api_base, ctx, host)
         headers: dict[str, str] = {}
         if token:
             headers['Authorization'] = f'Bearer {token}'
@@ -613,28 +675,30 @@ class GitHubDoctor(AnalysisCapability):
                 message=f'Set github-repository link to {html_url}.',
             )
 
-        # _REPAIR_EDGE: rewrite identifier + canonical URL + dashboard
-        # link in one ServiceWriteback.
+        # _REPAIR_EDGE: create or rewrite identifier + canonical URL +
+        # dashboard link in one ServiceWriteback.
         desired_canonical = f'{api_base}/repositories/{api_id}'
-        already_correct = (
-            connection.identifier == str(api_id)
-            and connection.canonical_url == desired_canonical
-            and ctx.project_links.get(slug) == html_url
-        )
-        if already_correct:
-            return RemediationResult(
-                status='noop',
-                message='EXISTS_IN edge already matches GitHub.',
+        if connection is not None:
+            already_correct = (
+                connection.identifier == str(api_id)
+                and connection.canonical_url == desired_canonical
+                and ctx.project_links.get(slug) == html_url
             )
+            if already_correct:
+                return RemediationResult(
+                    status='noop',
+                    message='EXISTS_IN edge already matches GitHub.',
+                )
         ctx.service_writeback = ServiceWriteback(
             identifier=str(api_id),
             canonical_url=desired_canonical,
             dashboard_links={slug: html_url},
         )
+        verb = 'Repaired' if connection is not None else 'Created'
         return RemediationResult(
             status='fixed',
             message=(
-                f'Repaired the EXISTS_IN edge for {slug!r} '
+                f'{verb} the EXISTS_IN edge for {slug!r} '
                 f'(identifier={api_id}).'
             ),
         )

{imbi_plugin_github-2.13.3 → imbi_plugin_github-2.14.1}/src/imbi_plugin_github/pull_requests.py

@@ -37,6 +37,7 @@ from imbi_common.plugins.base import (
     PullRequestSyncCapability,
 )
 
+from imbi_plugin_github._app_auth import AppNotInstalledError
 from imbi_plugin_github._hosts import host_to_api_base
 from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.commits import (
@@ -133,6 +134,21 @@ async def _fetch_all_prs(
         resp = await _request(
             client, 'GET', '/pulls', params=params, max_wait=max_wait
         )
+        if resp.status_code == 404:
+            if out:
+                LOGGER.warning(
+                    'github-pr-sync: repository %s returned 404; stopping '
+                    'after %d PRs',
+                    str(client.base_url).rstrip('/'),
+                    len(out),
+                )
+            else:
+                LOGGER.warning(
+                    'github-pr-sync: repository %s returned 404 (renamed '
+                    'or removed); nothing to sync',
+                    str(client.base_url).rstrip('/'),
+                )
+            return out
         resp.raise_for_status()
         page: list[dict[str, typing.Any]] = resp.json()
         if not page:
@@ -301,6 +317,11 @@ class GitHubPullRequestSync(PullRequestSyncCapability):
         Returns the number of PRs recorded.  Raises :class:`ValueError`
         only when the host or repository can't be resolved; ClickHouse
         failures are swallowed (the count reflects what was written).
+        Returns ``0`` (logged as a warning, no error) when the GitHub App
+        is not installed for the repo, or when the first page returns 404
+        (repo renamed/removed); a 404 on a later page stops pagination and
+        returns the PRs collected so far.  Neither condition fails the
+        backfill worker.
         Propagates :class:`PluginRateLimited` when a GitHub rate-limit
         reset is further out than ``_BACKFILL_MAX_WAIT_SECONDS`` so the
         host can pause the worker and keep the job queued until GitHub
@@ -314,7 +335,15 @@ class GitHubPullRequestSync(PullRequestSyncCapability):
             )
         base = host_to_api_base(host)
         owner, repo = resolve_owner_repo(ctx, host, _SELF_SLUG)
-        token = await _resolve_bearer(credentials, base, owner, repo)
+        try:
+            token = await _resolve_bearer(credentials, base, owner, repo)
+        except AppNotInstalledError as exc:
+            LOGGER.warning(
+                'github-pr-sync: %s; skipping backfill for project %s',
+                exc,
+                ctx.project_id,
+            )
+            return 0
         async with _client(base, owner, repo, token) as client:
             raw_prs = await _fetch_all_prs(
                 client, max_wait=_BACKFILL_MAX_WAIT_SECONDS