imbi-plugin-github 2.17.0__tar.gz → 2.18.0__tar.gz

{imbi_plugin_github-2.17.0 → imbi_plugin_github-2.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.17.0
+Version: 2.18.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.17.0
+Requires-Dist: imbi-common[databases]==2.18.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.17.0 → imbi_plugin_github-2.18.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.17.0"
+version = "2.18.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.17.0",
+  "imbi-common[databases]==2.18.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.17.0 → imbi_plugin_github-2.18.0}/src/imbi/plugins/github/deployment.py

@@ -26,6 +26,7 @@ import contextlib
 import datetime
 import hashlib
 import logging
+import re
 import time
 import typing
 import urllib.parse
@@ -1002,10 +1003,16 @@ class GitHubDeployment(DeploymentCapability):
         with explicit pagination if it ever needs to.
         """
         page_size = max(1, min(limit, 100))
+        # One run commonly backs several deployments in a sweep; cache
+        # the triggering-actor lookup by run id so we resolve each run
+        # at most once. Shared across the parallel per-env fan-out.
+        run_cache: dict[str, tuple[str, str] | None] = {}
         async with self._client(ctx, credentials) as client:
             per_env = await asyncio.gather(
                 *(
-                    self._list_deployments_for_env(client, env, page_size)
+                    self._list_deployments_for_env(
+                        client, env, page_size, run_cache
+                    )
                     for env in environments
                 )
             )
@@ -1035,6 +1042,7 @@ class GitHubDeployment(DeploymentCapability):
         client: httpx.AsyncClient,
         environment: str,
         page_size: int,
+        run_cache: dict[str, tuple[str, str] | None],
     ) -> list[RemoteDeployment]:
         try:
             resp = await client.get(
@@ -1067,7 +1075,7 @@ class GitHubDeployment(DeploymentCapability):
         observed: list[RemoteDeployment] = []
         for deployment in deployments:
             run = await self._observe_deployment(
-                client, environment, deployment
+                client, environment, deployment, run_cache
             )
             if run is not None:
                 observed.append(run)
@@ -1078,6 +1086,7 @@ class GitHubDeployment(DeploymentCapability):
         client: httpx.AsyncClient,
         environment: str,
         deployment: dict[str, typing.Any],
+        run_cache: dict[str, tuple[str, str] | None],
     ) -> RemoteDeployment | None:
         deployment_id = deployment.get('id')
         sha = deployment.get('sha')
@@ -1113,6 +1122,18 @@ class GitHubDeployment(DeploymentCapability):
             creator_id = creator_dict.get('id')
             if isinstance(creator_id, int):
                 creator_subject = str(creator_id)
+            # Deployments made by an Actions workflow carry the app bot
+            # as creator (``deployer[bot]``), never the human who
+            # triggered the run. Re-attribute to the run's triggering
+            # actor so the host can resolve the deploy to a real user.
+            if _is_bot(creator_dict):
+                run_id = _run_id_from_status_url(status_url)
+                if run_id is not None:
+                    actor = await self._resolve_triggering_actor(
+                        client, run_id, run_cache
+                    )
+                    if actor is not None:
+                        creator_login, creator_subject = actor
         return RemoteDeployment(
             environment=environment,
             sha=str(sha),
@@ -1128,6 +1149,53 @@ class GitHubDeployment(DeploymentCapability):
             creator_subject=creator_subject,
         )
 
+    async def _resolve_triggering_actor(
+        self,
+        client: httpx.AsyncClient,
+        run_id: str,
+        run_cache: dict[str, tuple[str, str] | None],
+    ) -> tuple[str, str] | None:
+        """Resolve a workflow run's human trigger to ``(login, subject)``.
+
+        Attributes a bot-created deployment to the person who started
+        the Actions run via ``GET /actions/runs/{run_id}``, preferring
+        ``triggering_actor`` (the account that re-ran or dispatched the
+        run) and falling back to ``actor``. Best-effort: a fetch/parse
+        error, a missing actor, or an actor that is itself a bot yields
+        ``None`` so the caller keeps the bot creator -- attribution must
+        never fail the resync. Results (including ``None``) are cached
+        per sweep because one run backs several deployments.
+        """
+        if run_id in run_cache:
+            return run_cache[run_id]
+        result: tuple[str, str] | None = None
+        try:
+            resp = await client.get(f'/actions/runs/{run_id}')
+            resp.raise_for_status()
+            run = typing.cast(dict[str, typing.Any], resp.json())
+        except (httpx.HTTPError, PluginAuthenticationFailed, ValueError):
+            LOGGER.warning(
+                'Failed to fetch workflow run %s for deploy attribution',
+                run_id,
+                exc_info=True,
+            )
+            run_cache[run_id] = None
+            return None
+        actor_raw = run.get('triggering_actor') or run.get('actor')
+        if isinstance(actor_raw, dict):
+            actor = typing.cast(dict[str, typing.Any], actor_raw)
+            login = actor.get('login')
+            actor_id = actor.get('id')
+            if (
+                isinstance(login, str)
+                and login
+                and isinstance(actor_id, int)
+                and not _is_bot(actor)
+            ):
+                result = (login, str(actor_id))
+        run_cache[run_id] = result
+        return result
+
     async def _release_notes_for_ref(
         self, client: httpx.AsyncClient, ref: str
     ) -> str | None:
@@ -1195,6 +1263,38 @@ class GitHubDeployment(DeploymentCapability):
         return _to_event_status(state), str(log_url) if log_url else None
 
 
+_RUN_ID_RE = re.compile(r'/actions/runs/(\d+)')
+
+
+def _is_bot(user: dict[str, typing.Any]) -> bool:
+    """Return ``True`` when a GitHub user object denotes an app/bot.
+
+    GitHub marks app identities with ``type == 'Bot'`` on the user
+    object and gives them a ``login`` suffixed ``[bot]``
+    (``github-actions[bot]``, ``deployer[bot]``). Either signal alone is
+    sufficient; both comparisons are case-insensitive.
+    """
+    if str(user.get('type') or '').lower() == 'bot':
+        return True
+    login = user.get('login')
+    return isinstance(login, str) and login.lower().endswith('[bot]')
+
+
+def _run_id_from_status_url(url: str | None) -> str | None:
+    """Extract the Actions run id from a deployment status URL.
+
+    A GitHub Actions deploy posts its status ``log_url``/``target_url``
+    pointing at the workflow run
+    (``.../actions/runs/{run_id}`` optionally followed by
+    ``/job/{job_id}``). Any URL that is not an Actions run link yields
+    ``None``.
+    """
+    if not url:
+        return None
+    match = _RUN_ID_RE.search(url)
+    return match.group(1) if match else None
+
+
 def _to_event_status(github_state: str) -> DeploymentEventStatus:
     """Map a GitHub deployment-status ``state`` to the host vocabulary.
 

{imbi_plugin_github-2.17.0 → imbi_plugin_github-2.18.0}/tests/test_deployment.py

@@ -1297,6 +1297,232 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertTrue(all(e.release_notes is None for e in events))
         self.assertEqual(first.call_count, 1)
 
+    @respx.mock
+    async def test_bot_creator_attributed_to_triggering_actor(self) -> None:
+        # A workflow-created deployment lists the app bot as creator; the
+        # status URL points at the Actions run, so attribution follows to
+        # the run's triggering actor (the human who started it).
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 123,
+                        'sha': 'botsha',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                        'creator': {
+                            'login': 'deployer[bot]',
+                            'id': 111,
+                            'type': 'Bot',
+                        },
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/123/statuses'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'state': 'success',
+                        'log_url': (
+                            'https://github.com/octo/demo'
+                            '/actions/runs/9001/job/55'
+                        ),
+                        'created_at': '2026-05-13T14:01:00Z',
+                    }
+                ],
+            )
+        )
+        run = respx.get(
+            'https://api.github.com/repos/octo/demo/actions/runs/9001'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'triggering_actor': {'login': 'octocat', 'id': 583231},
+                    'actor': {'login': 'someone-else', 'id': 42},
+                },
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(len(events), 1)
+        self.assertTrue(run.called)
+        self.assertEqual(events[0].creator, 'octocat')
+        self.assertEqual(events[0].creator_subject, '583231')
+
+    @respx.mock
+    async def test_bot_detection_is_case_insensitive(self) -> None:
+        # Bot detection must not depend on GitHub's casing: a creator
+        # with type 'bot' and a mixed-case '[Bot]' login suffix is still
+        # re-attributed to the run's triggering actor.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 123,
+                        'sha': 'botsha',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                        'creator': {
+                            'login': 'Deployer[Bot]',
+                            'id': 111,
+                            'type': 'bot',
+                        },
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/123/statuses'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'state': 'success',
+                        'log_url': (
+                            'https://github.com/octo/demo'
+                            '/actions/runs/9001/job/55'
+                        ),
+                        'created_at': '2026-05-13T14:01:00Z',
+                    }
+                ],
+            )
+        )
+        run = respx.get(
+            'https://api.github.com/repos/octo/demo/actions/runs/9001'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'triggering_actor': {'login': 'octocat', 'id': 583231},
+                },
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(len(events), 1)
+        self.assertTrue(run.called)
+        self.assertEqual(events[0].creator, 'octocat')
+        self.assertEqual(events[0].creator_subject, '583231')
+
+    @respx.mock
+    async def test_bot_creator_kept_when_run_fetch_fails(self) -> None:
+        # The run lookup 500s; attribution degrades gracefully to the bot
+        # creator rather than raising and failing the resync.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 123,
+                        'sha': 'botsha',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                        'creator': {
+                            'login': 'github-actions[bot]',
+                            'id': 111,
+                        },
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/123/statuses'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'state': 'success',
+                        'target_url': (
+                            'https://github.com/octo/demo/actions/runs/9001'
+                        ),
+                        'created_at': '2026-05-13T14:01:00Z',
+                    }
+                ],
+            )
+        )
+        run = respx.get(
+            'https://api.github.com/repos/octo/demo/actions/runs/9001'
+        ).mock(return_value=httpx.Response(500, json={'message': 'oops'}))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(len(events), 1)
+        self.assertTrue(run.called)
+        self.assertEqual(events[0].creator, 'github-actions[bot]')
+        self.assertEqual(events[0].creator_subject, '111')
+
+    @respx.mock
+    async def test_human_creator_skips_run_lookup(self) -> None:
+        # A human-created deployment must never issue the extra run
+        # fetch; the creator is used as-is.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 123,
+                        'sha': 'humansha',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                        'creator': {'login': 'octocat', 'id': 583231},
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/123/statuses'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'state': 'success',
+                        'log_url': (
+                            'https://github.com/octo/demo/actions/runs/9001'
+                        ),
+                        'created_at': '2026-05-13T14:01:00Z',
+                    }
+                ],
+            )
+        )
+        run = respx.get(
+            'https://api.github.com/repos/octo/demo/actions/runs/9001'
+        ).mock(return_value=httpx.Response(200, json={}))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(len(events), 1)
+        self.assertFalse(run.called)
+        self.assertEqual(events[0].creator, 'octocat')
+        self.assertEqual(events[0].creator_subject, '583231')
+
 
 class GetReleaseNotesTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock