imbi-plugin-github 2.16.1__tar.gz → 2.18.0__tar.gz

imbi_plugin_github-2.18.0/.gitignore

@@ -0,0 +1,22 @@
+__pycache__
+*.egg-info
+*.pyc
+*.env
+.env
+.env.test
+build/
+dist/
+docs/site/
+helm/imbi/charts/
+runtime/state/
+.venv/
+.coverage
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+coverage.xml
+site/
+
+# moon
+.moon/cache
+.moon/docker

{imbi_plugin_github-2.16.1 → imbi_plugin_github-2.18.0}/PKG-INFO

@@ -1,10 +1,9 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.16.1
+Version: 2.18.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
-License: BSD-3-Clause
-License-File: LICENSE
+License-Expression: BSD-3-Clause
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Natural Language :: English
@@ -13,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.16.1
+Requires-Dist: imbi-common[databases]==2.18.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

imbi_plugin_github-2.18.0/moon.yml

@@ -0,0 +1,22 @@
+# yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json
+layer: 'library'
+stack: 'backend'
+language: 'python'
+tags:
+  - 'python'
+
+project:
+  name: 'imbi-plugin-github'
+  description: 'GitHub identity plugin for Imbi'
+
+dependsOn:
+  - 'common'
+
+# Inherits lint / format / typecheck / test from .moon/tasks/python.yml. The
+# shared test task points --cov-config at this member's pyproject, where
+# [tool.coverage] scopes source + threshold to the member.
+tasks:
+  test:
+    args:
+      - '--cov'
+      - '--cov-report=term-missing'

imbi_plugin_github-2.18.0/pyproject.toml

@@ -0,0 +1,46 @@
+[project]
+name = "imbi-plugin-github"
+version = "2.18.0"
+description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
+readme = "README.md"
+requires-python = ">=3.14"
+license = "BSD-3-Clause"
+authors = [
+  { name = "Gavin M. Roy", email = "gavinr@aweber.com" },
+]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Natural Language :: English",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.14",
+]
+dependencies = [
+  "httpx>=0.27",
+  "imbi-common[databases]==2.18.0",
+  "pydantic>=2",
+  "pyjwt[crypto]>=2.8",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+# Coverage for the per-member `moon run github:test` run. Scoped to this
+# member so the report/threshold reflect only imbi.plugins.github; the aggregate
+# `root:coverage` run uses the root pyproject config instead.
+[tool.coverage.run]
+branch = true
+source_pkgs = ["imbi.plugins.github"]
+
+[tool.coverage.report]
+exclude_also = ["typing.TYPE_CHECKING"]
+fail_under = 85
+show_missing = true
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/imbi"]
+include = [
+  "src/imbi/plugins/github/py.typed",
+]

imbi_plugin_github-2.18.0/src/imbi/plugins/github/README.md

@@ -0,0 +1,107 @@
+# imbi-plugin-github
+
+GitHub plugins for Imbi. Three flavors (github.com, GitHub Enterprise Cloud,
+GitHub Enterprise Server) of each plugin type so the admin UI can wire
+projects to the right backend.
+
+## Plugin types
+
+| Type       | Slugs                                                                |
+| ---------- | -------------------------------------------------------------------- |
+| Identity   | `github`, `github-enterprise-cloud`, `github-enterprise-server`      |
+| Deployment | `github-deployment`, `github-deployment-ec`, `github-deployment-es`  |
+| Lifecycle  | `github-lifecycle`, `github-lifecycle-ec`, `github-lifecycle-es`     |
+| Webhook    | `github-commit-sync`                                                  |
+
+### Identity
+
+Implements the OAuth App flow. The access token returned by the OAuth
+grant is passed straight to GitHub APIs as a `Bearer` token, so
+`materialize()` is a no-op.
+
+### Deployment
+
+Drives the GitHub Deployments API (`POST /repos/{owner}/{repo}/deployments`)
+plus tag and release creation. Promote behaviour is inferred from the
+ref shape by the host (semver → trigger Deployment, raw SHA → cut tag
++ Release).  Per-env workflow inputs ride on the `USES_PLUGIN` edge as
+`env_payloads` and arrive on `PluginContext.environment_config`.
+
+### Lifecycle
+
+Reacts to project archive / unarchive by archiving the matching repo via
+`PATCH /repos/{owner}/{repo}` with `{"archived": true|false}`. When the
+`archive_target_org` option is set, archive **also** transfers the repo to
+that org first via `POST /repos/{owner}/{repo}/transfer` — useful for
+moving sunset projects into a dedicated "archive" org so they no longer
+crowd primary-org searches.
+
+GitHub refuses to transfer archived repos, so an already-archived source
+is briefly unarchived, transferred, and re-archived at the destination.
+On unarchive the plugin only flips `archived` back to `false` at the
+repo's current location — it does **not** transfer back to the original
+org.
+
+Archiving requires admin scope on the repo; transferring additionally
+requires admin permission on the target organization.
+
+### Webhook (commit / tag sync)
+
+A single `github-commit-sync` webhook-action plugin exposes two actions
+the gateway dispatches on `push` deliveries:
+
+| Action         | Handler                          | Records into ClickHouse |
+| -------------- | -------------------------------- | ----------------------- |
+| `sync_commits` | `github-commit-sync#sync_commits`| `commits`               |
+| `sync_tags`    | `github-commit-sync#sync_tags`   | `tags`                  |
+
+`sync_commits` fetches the full set of commits in a push via the compare
+API (paginated, so it isn't capped by the 20-commit inline payload limit);
+`sync_tags` records the pushed tag and, with `reconcile_all`, the repo's
+full tag list. Branch/tag gating is the rule's CEL `filter_expression`
+(e.g. `ref == "refs/heads/main"`, `ref.startsWith("refs/tags/")`). The API
+flavor (github.com / GHEC / GHES) is resolved at runtime — explicit
+`api_base_url`, else a connected GitHub plugin on the same service, else
+the service endpoint, else the payload's `repository.url`.
+
+Unlike identity/deployment/lifecycle (which act as the OAuth user),
+commit-sync runs without an actor and authenticates with a **service**
+credential in one of two modes, resolved per call:
+
+- **PAT** — a static `access_token`.
+- **GitHub App** — `app_id` + `private_key`; the plugin signs an App JWT
+  and mints a short-lived **installation token** (cached process-wide
+  until shortly before it expires), so no static, expiring token is
+  stored. `installation_id` is optional — when unset it is discovered
+  from the pushed repository (`GET /repos/{owner}/{repo}/installation`).
+  The App needs **Contents: Read-only**.
+
+## Manifest options (identity)
+
+| Option           | Required  | Description                                                                |
+| ---------------- | --------- | -------------------------------------------------------------------------- |
+| `host`           | GHEC/GHES | Tenant or appliance host (e.g. `tenant.ghe.com`, `github.example.com`).    |
+| `default_scopes` | no        | Space-separated default OAuth scopes (default: `read:user user:email repo workflow`). |
+
+## Credentials (identity)
+
+| Field            | Required |
+| ---------------- | -------- |
+| `client_id`      | yes      |
+| `client_secret`  | yes      |
+
+## Credentials (commit-sync)
+
+Provide **either** the PAT field **or** the GitHub App fields (all
+individually optional; validated per call):
+
+| Field             | Mode | Description                                            |
+| ----------------- | ---- | ------------------------------------------------------ |
+| `access_token`    | PAT  | Static personal/service token.                         |
+| `app_id`          | App  | GitHub App identifier.                                 |
+| `private_key`     | App  | App private key — raw PEM or base64-encoded PEM.       |
+| `installation_id` | App  | Optional; discovered from the repo when unset.         |
+
+## License
+
+BSD-3-Clause.

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/__init__.py

@@ -1,11 +1,11 @@
 """Imbi GitHub plugin (Architecture v3).
 
-One :class:`~imbi_plugin_github.plugin.GitHubPlugin` backs every GitHub
+One :class:`~imbi.plugins.github.plugin.GitHubPlugin` backs every GitHub
 Integration. The registry discovers this package by its ``imbi_plugin_*``
 name and reads the module-level :data:`PLUGIN` attribute.
 """
 
-from imbi_plugin_github.plugin import GitHubPlugin
+from imbi.plugins.github.plugin import GitHubPlugin
 
 #: The package's single plugin, discovered by the registry convention scan.
 PLUGIN = GitHubPlugin

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/_app_auth.py

@@ -9,7 +9,7 @@ per hour per ``(app, installation, host)`` rather than one per webhook
 delivery.
 
 All three GitHub flavors work unchanged: the caller resolves the API
-base via :func:`imbi_plugin_github._hosts.host_to_api_base` and passes
+base via :func:`imbi.plugins.github._hosts.host_to_api_base` and passes
 it in, so the JWT exchange hits ``api.github.com``,
 ``api.<tenant>.ghe.com``, or ``<ghes>/api/v3`` as appropriate.
 """
@@ -26,7 +26,7 @@ import typing
 import httpx
 import jwt
 
-from imbi_plugin_github.deployment import (
+from imbi.plugins.github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
     _raise_on_401,  # pyright: ignore[reportPrivateUsage]
 )

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/_repos.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 
 import urllib.parse
 
-from imbi_common.plugins.base import PluginContext
+from imbi.common.plugins.base import PluginContext
 
 # Reserved GitHub URL prefixes that share the host with repository URLs
 # but never point at a real ``<owner>/<repo>`` pair.  Any link whose

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/commits.py

@@ -20,7 +20,7 @@ it walks the full default-branch history and the complete tag list rather
 than a single push delta.
 
 Commit / tag rows are written to the shared ClickHouse ``commits`` /
-``tags`` tables via :func:`imbi_common.clickhouse.insert`. Writes are
+``tags`` tables via :func:`imbi.common.clickhouse.insert`. Writes are
 best-effort: a storage failure is logged and swallowed so an analytics
 hiccup never 5xxs the webhook, exactly as the gateway's own event
 recording behaves.
@@ -40,21 +40,21 @@ import urllib.parse
 import httpx
 import jsonpointer
 import pydantic
-from imbi_common import clickhouse
-from imbi_common.json_pointer import JsonPointer
-from imbi_common.models import CommitRecord, TagRecord
-from imbi_common.plugins.base import (
+
+from imbi.common import clickhouse
+from imbi.common.json_pointer import JsonPointer
+from imbi.common.models import CommitRecord, TagRecord
+from imbi.common.plugins.base import (
     ActionDescriptor,
     CheckStatus,
     CommitSyncCapability,
     PluginContext,
 )
-from imbi_common.plugins.errors import PluginRateLimited
-
-from imbi_plugin_github import _app_auth
-from imbi_plugin_github._hosts import host_to_api_base, resolve_host
-from imbi_plugin_github._repos import resolve_owner_repo
-from imbi_plugin_github.deployment import (
+from imbi.common.plugins.errors import PluginRateLimited
+from imbi.plugins.github import _app_auth
+from imbi.plugins.github._hosts import host_to_api_base, resolve_host
+from imbi.plugins.github._repos import resolve_owner_repo
+from imbi.plugins.github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
     _check_runs_to_status,  # pyright: ignore[reportPrivateUsage]
     _checks_disabled,  # pyright: ignore[reportPrivateUsage]
@@ -254,7 +254,7 @@ async def _resolve_bearer(
 ) -> str:
     """Resolve the Bearer token used for the repo's GitHub API calls.
 
-    Thin wrapper over :func:`imbi_plugin_github._app_auth.resolve_bearer`
+    Thin wrapper over :func:`imbi.plugins.github._app_auth.resolve_bearer`
     (the single source of truth), kept as a module-local name for the
     commit-sync call sites and tests.
     """
@@ -263,10 +263,7 @@ async def _resolve_bearer(
 
 def _resolve(pointer: jsonpointer.JsonPointer, event: object) -> object:
     """Resolve a JSON Pointer against the event, ``None`` if absent."""
-    return typing.cast(
-        'object',
-        pointer.resolve(event, None),  # pyright: ignore[reportUnknownMemberType]
-    )
+    return pointer.resolve(event, None)
 
 
 def _branch_short_name(ref: str) -> str:
@@ -721,7 +718,7 @@ async def _insert_best_effort(
 ) -> int:
     """Insert ``records`` into ``table``; return rows written (0 on fail).
 
-    ``imbi_common.clickhouse.insert`` rejects an empty list, so an empty
+    ``imbi.common.clickhouse.insert`` rejects an empty list, so an empty
     set short-circuits to 0.  A storage failure is logged and swallowed,
     mirroring the webhook actions -- an analytics hiccup must not fail the
     sync.
@@ -1178,10 +1175,10 @@ sync_commits_descriptor = ActionDescriptor(
         'API) and record them in the ClickHouse commits table.'
     ),
     callable=typing.cast(
-        'typing.Any', 'imbi_plugin_github.commits:sync_commits'
+        'typing.Any', 'imbi.plugins.github.commits:sync_commits'
     ),
     config_model=typing.cast(
-        'typing.Any', 'imbi_plugin_github.commits:SyncCommitsConfig'
+        'typing.Any', 'imbi.plugins.github.commits:SyncCommitsConfig'
     ),
 )
 
@@ -1192,9 +1189,11 @@ sync_tags_descriptor = ActionDescriptor(
         'Record the pushed tag (and, when reconcile_all is set, the full '
         'tag list) in the ClickHouse tags table.'
     ),
-    callable=typing.cast('typing.Any', 'imbi_plugin_github.commits:sync_tags'),
+    callable=typing.cast(
+        'typing.Any', 'imbi.plugins.github.commits:sync_tags'
+    ),
     config_model=typing.cast(
-        'typing.Any', 'imbi_plugin_github.commits:SyncTagsConfig'
+        'typing.Any', 'imbi.plugins.github.commits:SyncTagsConfig'
     ),
 )
 

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/deployment.py

@@ -26,12 +26,14 @@ import contextlib
 import datetime
 import hashlib
 import logging
+import re
 import time
 import typing
 import urllib.parse
 
 import httpx
-from imbi_common.plugins.base import (
+
+from imbi.common.plugins.base import (
     CheckStatus,
     Commit,
     CompareResult,
@@ -46,10 +48,9 @@ from imbi_common.plugins.base import (
     RemoteDeployment,
     WorkflowFile,
 )
-from imbi_common.plugins.errors import PluginAuthenticationFailed
-
-from imbi_plugin_github._hosts import flavor_host, host_to_api_base
-from imbi_plugin_github._repos import (
+from imbi.common.plugins.errors import PluginAuthenticationFailed
+from imbi.plugins.github._hosts import flavor_host, host_to_api_base
+from imbi.plugins.github._repos import (
     derive_owner_repo_from_links,
     parse_owner_repo,
     resolve_owner_repo,
@@ -345,7 +346,7 @@ class GitHubDeployment(DeploymentCapability):
         )
 
     # Backwards-compatible aliases for the previously private helpers.
-    # The actual logic lives in :mod:`imbi_plugin_github._repos`; these
+    # The actual logic lives in :mod:`imbi.plugins.github._repos`; these
     # remain so existing tests that reach into the class continue to
     # work and so subclasses overriding the resolution path still have
     # a stable surface to hook into.
@@ -378,7 +379,7 @@ class GitHubDeployment(DeploymentCapability):
         """
         # Local import: ``_app_auth`` imports this module for its shared
         # HTTP helpers, so a top-level import here would be circular.
-        from imbi_plugin_github import _app_auth
+        from imbi.plugins.github import _app_auth
 
         owner, repo = self._owner_repo(ctx)
         return await _app_auth.resolve_bearer(
@@ -397,7 +398,7 @@ class GitHubDeployment(DeploymentCapability):
         ``raise_for_status``.  A response hook records that redirect; once
         the caller's request succeeds we resolve the repo's new
         ``full_name``/``html_url`` and stash a
-        :class:`~imbi_common.plugins.base.LinkWriteback` on ``ctx`` so the
+        :class:`~imbi.common.plugins.base.LinkWriteback` on ``ctx`` so the
         host can persist the project's updated stored link.  This is the
         single chokepoint for every deployment call.
         """
@@ -1002,10 +1003,16 @@ class GitHubDeployment(DeploymentCapability):
         with explicit pagination if it ever needs to.
         """
         page_size = max(1, min(limit, 100))
+        # One run commonly backs several deployments in a sweep; cache
+        # the triggering-actor lookup by run id so we resolve each run
+        # at most once. Shared across the parallel per-env fan-out.
+        run_cache: dict[str, tuple[str, str] | None] = {}
         async with self._client(ctx, credentials) as client:
             per_env = await asyncio.gather(
                 *(
-                    self._list_deployments_for_env(client, env, page_size)
+                    self._list_deployments_for_env(
+                        client, env, page_size, run_cache
+                    )
                     for env in environments
                 )
             )
@@ -1035,6 +1042,7 @@ class GitHubDeployment(DeploymentCapability):
         client: httpx.AsyncClient,
         environment: str,
         page_size: int,
+        run_cache: dict[str, tuple[str, str] | None],
     ) -> list[RemoteDeployment]:
         try:
             resp = await client.get(
@@ -1067,7 +1075,7 @@ class GitHubDeployment(DeploymentCapability):
         observed: list[RemoteDeployment] = []
         for deployment in deployments:
             run = await self._observe_deployment(
-                client, environment, deployment
+                client, environment, deployment, run_cache
             )
             if run is not None:
                 observed.append(run)
@@ -1078,6 +1086,7 @@ class GitHubDeployment(DeploymentCapability):
         client: httpx.AsyncClient,
         environment: str,
         deployment: dict[str, typing.Any],
+        run_cache: dict[str, tuple[str, str] | None],
     ) -> RemoteDeployment | None:
         deployment_id = deployment.get('id')
         sha = deployment.get('sha')
@@ -1113,6 +1122,18 @@ class GitHubDeployment(DeploymentCapability):
             creator_id = creator_dict.get('id')
             if isinstance(creator_id, int):
                 creator_subject = str(creator_id)
+            # Deployments made by an Actions workflow carry the app bot
+            # as creator (``deployer[bot]``), never the human who
+            # triggered the run. Re-attribute to the run's triggering
+            # actor so the host can resolve the deploy to a real user.
+            if _is_bot(creator_dict):
+                run_id = _run_id_from_status_url(status_url)
+                if run_id is not None:
+                    actor = await self._resolve_triggering_actor(
+                        client, run_id, run_cache
+                    )
+                    if actor is not None:
+                        creator_login, creator_subject = actor
         return RemoteDeployment(
             environment=environment,
             sha=str(sha),
@@ -1128,6 +1149,53 @@ class GitHubDeployment(DeploymentCapability):
             creator_subject=creator_subject,
         )
 
+    async def _resolve_triggering_actor(
+        self,
+        client: httpx.AsyncClient,
+        run_id: str,
+        run_cache: dict[str, tuple[str, str] | None],
+    ) -> tuple[str, str] | None:
+        """Resolve a workflow run's human trigger to ``(login, subject)``.
+
+        Attributes a bot-created deployment to the person who started
+        the Actions run via ``GET /actions/runs/{run_id}``, preferring
+        ``triggering_actor`` (the account that re-ran or dispatched the
+        run) and falling back to ``actor``. Best-effort: a fetch/parse
+        error, a missing actor, or an actor that is itself a bot yields
+        ``None`` so the caller keeps the bot creator -- attribution must
+        never fail the resync. Results (including ``None``) are cached
+        per sweep because one run backs several deployments.
+        """
+        if run_id in run_cache:
+            return run_cache[run_id]
+        result: tuple[str, str] | None = None
+        try:
+            resp = await client.get(f'/actions/runs/{run_id}')
+            resp.raise_for_status()
+            run = typing.cast(dict[str, typing.Any], resp.json())
+        except (httpx.HTTPError, PluginAuthenticationFailed, ValueError):
+            LOGGER.warning(
+                'Failed to fetch workflow run %s for deploy attribution',
+                run_id,
+                exc_info=True,
+            )
+            run_cache[run_id] = None
+            return None
+        actor_raw = run.get('triggering_actor') or run.get('actor')
+        if isinstance(actor_raw, dict):
+            actor = typing.cast(dict[str, typing.Any], actor_raw)
+            login = actor.get('login')
+            actor_id = actor.get('id')
+            if (
+                isinstance(login, str)
+                and login
+                and isinstance(actor_id, int)
+                and not _is_bot(actor)
+            ):
+                result = (login, str(actor_id))
+        run_cache[run_id] = result
+        return result
+
     async def _release_notes_for_ref(
         self, client: httpx.AsyncClient, ref: str
     ) -> str | None:
@@ -1195,6 +1263,38 @@ class GitHubDeployment(DeploymentCapability):
         return _to_event_status(state), str(log_url) if log_url else None
 
 
+_RUN_ID_RE = re.compile(r'/actions/runs/(\d+)')
+
+
+def _is_bot(user: dict[str, typing.Any]) -> bool:
+    """Return ``True`` when a GitHub user object denotes an app/bot.
+
+    GitHub marks app identities with ``type == 'Bot'`` on the user
+    object and gives them a ``login`` suffixed ``[bot]``
+    (``github-actions[bot]``, ``deployer[bot]``). Either signal alone is
+    sufficient; both comparisons are case-insensitive.
+    """
+    if str(user.get('type') or '').lower() == 'bot':
+        return True
+    login = user.get('login')
+    return isinstance(login, str) and login.lower().endswith('[bot]')
+
+
+def _run_id_from_status_url(url: str | None) -> str | None:
+    """Extract the Actions run id from a deployment status URL.
+
+    A GitHub Actions deploy posts its status ``log_url``/``target_url``
+    pointing at the workflow run
+    (``.../actions/runs/{run_id}`` optionally followed by
+    ``/job/{job_id}``). Any URL that is not an Actions run link yields
+    ``None``.
+    """
+    if not url:
+        return None
+    match = _RUN_ID_RE.search(url)
+    return match.group(1) if match else None
+
+
 def _to_event_status(github_state: str) -> DeploymentEventStatus:
     """Map a GitHub deployment-status ``state`` to the host vocabulary.
 

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/doctor.py

@@ -20,7 +20,8 @@ import re
 import typing
 
 import httpx
-from imbi_common.plugins.base import (
+
+from imbi.common.plugins.base import (
     AnalysisCapability,
     AnalysisResultItem,
     AnalysisResultStatus,
@@ -31,14 +32,13 @@ from imbi_common.plugins.base import (
     ServiceConnection,
     ServiceWriteback,
 )
-from imbi_common.plugins.errors import PluginAuthenticationFailed
-
-from imbi_plugin_github._hosts import (
+from imbi.common.plugins.errors import PluginAuthenticationFailed
+from imbi.plugins.github._hosts import (
     flavor_host,
     host_to_api_base,
 )
-from imbi_plugin_github._repos import derive_owner_repo_from_links
-from imbi_plugin_github.commits import (
+from imbi.plugins.github._repos import derive_owner_repo_from_links
+from imbi.plugins.github.commits import (
     _resolve_bearer,  # pyright: ignore[reportPrivateUsage]
 )
 

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/identity.py

@@ -18,15 +18,15 @@ import typing
 import urllib.parse
 
 import httpx
-from imbi_common.plugins.base import (
+
+from imbi.common.plugins.base import (
     AuthorizationRequest,
     IdentityCapability,
     IdentityCredentials,
     IdentityProfile,
     PluginContext,
 )
-
-from imbi_plugin_github._hosts import flavor_host, host_to_api_base
+from imbi.plugins.github._hosts import flavor_host, host_to_api_base
 
 LOGGER = logging.getLogger(__name__)
 

{imbi_plugin_github-2.16.1/src/imbi_plugin_github → imbi_plugin_github-2.18.0/src/imbi/plugins/github}/lifecycle.py

@@ -47,7 +47,8 @@ import logging
 import typing
 
 import httpx
-from imbi_common.plugins.base import (
+
+from imbi.common.plugins.base import (
     LifecycleCapability,
     LifecycleResult,
     LinkWriteback,
@@ -55,11 +56,10 @@ from imbi_common.plugins.base import (
     RelocationTarget,
     ServiceWriteback,
 )
-from imbi_common.plugins.errors import PluginAuthenticationFailed
-from imbi_common.plugins.templates import expand_template
-
-from imbi_plugin_github._hosts import flavor_host, host_to_api_base
-from imbi_plugin_github._repos import (
+from imbi.common.plugins.errors import PluginAuthenticationFailed
+from imbi.common.plugins.templates import expand_template
+from imbi.plugins.github._hosts import flavor_host, host_to_api_base
+from imbi.plugins.github._repos import (
     derive_owner_repo_from_links,
     resolve_owner_repo,
 )