imbi-plugin-github 2.23.0__tar.gz → 2.25.0__tar.gz

{imbi_plugin_github-2.23.0 → imbi_plugin_github-2.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.23.0
+Version: 2.25.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.23.0
+Requires-Dist: imbi-common[databases]==2.25.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.23.0 → imbi_plugin_github-2.25.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.23.0"
+version = "2.25.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.23.0",
+  "imbi-common[databases]==2.25.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.23.0 → imbi_plugin_github-2.25.0}/src/imbi/plugins/github/deployment.py

@@ -2,7 +2,10 @@
 
 :class:`GitHubDeployment` resolves its host from the Integration's
 ``flavor`` + ``host`` options on ``ctx.integration_options`` (github.com,
-a ``*.ghe.com`` GHEC tenant, or an operator-managed GHES appliance).
+a ``*.ghe.com`` GHEC tenant, or an operator-managed GHES appliance), and
+reads ``mainline_branches`` from the same map to know which deployment
+refs are branches rather than release tags (see
+:func:`_mainline_branches`).
 
 *Deploying* drives the GitHub Deployments API
 (``POST /repos/{owner}/{repo}/deployments``) rather than
@@ -371,6 +374,40 @@ def _record_releases_forbidden(client: httpx.AsyncClient) -> None:
     _RELEASES_FORBIDDEN_TOKENS[_releases_cache_key(client)] = now
 
 
+# Fallback for the ``mainline_branches`` integration option: deployment
+# refs that are branch names rather than release tags. A repo that deploys
+# off its default branch reports ``ref == 'main'`` on every deployment, so
+# ``GET /releases/tags/main`` is a guaranteed 404 — skip the request
+# outright instead of paying for it once per deployment row.
+_DEFAULT_MAINLINE_BRANCHES = frozenset({'main', 'master'})
+
+
+def _mainline_branches(
+    integration_options: dict[str, typing.Any],
+) -> frozenset[str]:
+    """Resolve the ``mainline_branches`` integration option to a set.
+
+    Declared integration-level (beside ``flavor`` / ``host``) because
+    mainline branch naming is a property of the org's repos rather than of
+    any one capability, so every capability can read the same value.  The
+    manifest's ``default`` is a form pre-fill only -- the host does not
+    substitute it -- so an absent or blank value resolves to
+    :data:`_DEFAULT_MAINLINE_BRANCHES` here, mirroring how
+    ``artifact_version_input`` re-applies its own default.  Consequently
+    the guard can be *retargeted* but not switched off; a repo that cuts
+    releases tagged with a branch name is not a case worth supporting.
+
+    Operator-entered, so tolerate commas as well as the advertised spaces
+    and discard surrounding whitespace -- a stray separator would
+    otherwise register as a branch named ``''``.
+    """
+    raw = integration_options.get('mainline_branches')
+    if not isinstance(raw, str):
+        return _DEFAULT_MAINLINE_BRANCHES
+    configured = frozenset(raw.replace(',', ' ').split())
+    return configured or _DEFAULT_MAINLINE_BRANCHES
+
+
 def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     """Convert a GitHub commit list/object payload into a :class:`Commit`."""
     sha = str(payload.get('sha', ''))
@@ -1221,11 +1258,25 @@ class GitHubDeployment(DeploymentCapability):
         # the triggering-actor lookup by run id so we resolve each run
         # at most once. Shared across the parallel per-env fan-out.
         run_cache: dict[str, tuple[str, str] | None] = {}
+        # Likewise, deployments in a sweep share a handful of refs; the
+        # lookup for each is memoised here as a task so it happens once
+        # per ref instead of once per deployment. Holding the task (not
+        # its result) also coalesces the per-env fan-out below: envs that
+        # deployed the same ref await one in-flight request rather than
+        # each issuing their own, which is the common shape at the host's
+        # default limit=1 where no single env repeats a ref.
+        release_lookups: dict[str, asyncio.Task[RemoteRelease | None]] = {}
+        mainline = _mainline_branches(ctx.integration_options)
         async with self._client(ctx, credentials) as client:
             per_env = await asyncio.gather(
                 *(
                     self._list_deployments_for_env(
-                        client, env, page_size, run_cache
+                        client,
+                        env,
+                        page_size,
+                        run_cache,
+                        release_lookups,
+                        mainline,
                     )
                     for env in environments
                 )
@@ -1248,8 +1299,9 @@ class GitHubDeployment(DeploymentCapability):
         which 404s to ``None`` for tags without a release and caches 403s
         so a scope-limited token short-circuits.
         """
+        mainline = _mainline_branches(ctx.integration_options)
         async with self._client(ctx, credentials) as client:
-            return await self._release_notes_for_ref(client, tag)
+            return await self._release_notes_for_ref(client, tag, mainline)
 
     async def _list_deployments_for_env(
         self,
@@ -1257,6 +1309,8 @@ class GitHubDeployment(DeploymentCapability):
         environment: str,
         page_size: int,
         run_cache: dict[str, tuple[str, str] | None],
+        release_lookups: dict[str, asyncio.Task[RemoteRelease | None]],
+        mainline: frozenset[str],
     ) -> list[RemoteDeployment]:
         try:
             resp = await client.get(
@@ -1289,7 +1343,12 @@ class GitHubDeployment(DeploymentCapability):
         observed: list[RemoteDeployment] = []
         for deployment in deployments:
             run = await self._observe_deployment(
-                client, environment, deployment, run_cache
+                client,
+                environment,
+                deployment,
+                run_cache,
+                release_lookups,
+                mainline,
             )
             if run is not None:
                 observed.append(run)
@@ -1301,6 +1360,8 @@ class GitHubDeployment(DeploymentCapability):
         environment: str,
         deployment: dict[str, typing.Any],
         run_cache: dict[str, tuple[str, str] | None],
+        release_lookups: dict[str, asyncio.Task[RemoteRelease | None]],
+        mainline: frozenset[str],
     ) -> RemoteDeployment | None:
         deployment_id = deployment.get('id')
         sha = deployment.get('sha')
@@ -1318,7 +1379,9 @@ class GitHubDeployment(DeploymentCapability):
         ref_value = deployment.get('ref')
         description = deployment.get('description')
         release_notes = (
-            await self._release_notes_for_ref(client, str(ref_value))
+            await self._release_notes_for_ref(
+                client, str(ref_value), mainline, release_lookups
+            )
             if ref_value
             else None
         )
@@ -1411,18 +1474,53 @@ class GitHubDeployment(DeploymentCapability):
         return result
 
     async def _release_for_ref(
-        self, client: httpx.AsyncClient, ref: str
+        self,
+        client: httpx.AsyncClient,
+        ref: str,
+        mainline: frozenset[str],
+        release_lookups: dict[str, asyncio.Task[RemoteRelease | None]]
+        | None = None,
     ) -> RemoteRelease | None:
         """Return the GitHub release for ``ref``, metadata included.
 
-        The single release lookup every caller degrades through: a 404 /
-        non-200 / parse failure yields ``None``, and a ``403`` (token lacks
-        scope to read releases) is cached process-wide so a forbidden token
-        short-circuits instead of re-issuing the request for every
+        Refs in ``mainline`` (the resolved ``mainline_branches`` option)
+        never name a release, so they never reach the API.
+
+        ``release_lookups`` memoises one lookup per ref for the duration of
+        a sweep.  It holds the in-flight task rather than its result, so
+        the parallel per-env fan-out in
+        :meth:`list_recent_deployments` coalesces onto a single request
+        when several environments deployed the same ref -- checking a
+        result-only cache would let every env past the check before the
+        first response landed.  Like ``run_cache`` it memoises every
+        outcome, failures included, so one sweep never retries a ref that
+        just errored; it is scoped the same way (one sweep, one repo, one
+        token), and omitting it disables the memo for one-off host-facing
+        lookups.
+        """
+        if ref in mainline:
+            return None
+        if release_lookups is None:
+            return await self._fetch_release(client, ref)
+        task = release_lookups.get(ref)
+        if task is None:
+            task = asyncio.ensure_future(self._fetch_release(client, ref))
+            release_lookups[ref] = task
+        return await task
+
+    async def _fetch_release(
+        self, client: httpx.AsyncClient, ref: str
+    ) -> RemoteRelease | None:
+        """Issue the release lookup for ``ref`` and shape the response.
+
+        The single release request every caller degrades through: a 404 /
+        410 / non-200 / parse failure yields ``None``, and a ``403`` (token
+        lacks scope to read releases) is cached process-wide so a forbidden
+        token short-circuits instead of re-issuing the request for every
         deployment on every resync sweep.  ``author`` is the login GitHub
-        credits with the release and ``author_subject`` its numeric user id,
-        which the host resolves to an Imbi user through the identity plugins
-        on the same service.
+        credits with the release and ``author_subject`` its numeric user
+        id, which the host resolves to an Imbi user through the identity
+        plugins on the same service.
         """
         if _releases_forbidden(client):
             return None
@@ -1464,11 +1562,17 @@ class GitHubDeployment(DeploymentCapability):
         tag: str,
     ) -> RemoteRelease | None:
         """Return the GitHub release for ``tag`` with its author."""
+        mainline = _mainline_branches(ctx.integration_options)
         async with self._client(ctx, credentials) as client:
-            return await self._release_for_ref(client, tag)
+            return await self._release_for_ref(client, tag, mainline)
 
     async def _release_notes_for_ref(
-        self, client: httpx.AsyncClient, ref: str
+        self,
+        client: httpx.AsyncClient,
+        ref: str,
+        mainline: frozenset[str],
+        release_lookups: dict[str, asyncio.Task[RemoteRelease | None]]
+        | None = None,
     ) -> str | None:
         """Return the GitHub release notes body for a deployed ref.
 
@@ -1479,7 +1583,9 @@ class GitHubDeployment(DeploymentCapability):
         ``None`` -- resync is never blocked by a missing or unreadable
         release.
         """
-        release = await self._release_for_ref(client, ref)
+        release = await self._release_for_ref(
+            client, ref, mainline, release_lookups
+        )
         return release.body_markdown if release else None
 
     async def _latest_status(

{imbi_plugin_github-2.23.0 → imbi_plugin_github-2.25.0}/src/imbi/plugins/github/plugin.py

@@ -81,6 +81,22 @@ _OPTIONS: list[PluginOption] = [
         ),
         type='string',
     ),
+    PluginOption(
+        name='mainline_branches',
+        label='Mainline branches (space-separated)',
+        description=(
+            'Branch names your repos deploy from, which therefore never '
+            'name a GitHub Release.  Deployment resync skips the release '
+            'lookup for a deployment whose ref is one of these instead of '
+            'issuing a request that is certain to 404 -- a repo deploying '
+            'off its default branch would otherwise pay for one doomed '
+            'lookup per deployment row.  Commas or spaces both separate; '
+            'leave blank for the ``main master`` default.'
+        ),
+        type='string',
+        required=False,
+        default='main master',
+    ),
 ]
 
 # The single credential store for the Integration. Every capability of

{imbi_plugin_github-2.23.0 → imbi_plugin_github-2.25.0}/tests/test_deployment.py

@@ -17,6 +17,7 @@ from imbi.common.plugins.errors import PluginAuthenticationFailed
 from imbi.plugins.github.deployment import (
     GitHubDeployment,
     _artifact_status,
+    _mainline_branches,
     _repo_root_from_redirect,
 )
 from imbi.plugins.github.plugin import GitHubPlugin
@@ -91,6 +92,21 @@ class ManifestTestCase(unittest.TestCase):
         self.assertFalse(options['artifact_workflow'].required)
         self.assertEqual(options['artifact_version_input'].default, 'version')
 
+    def test_mainline_branches_declared_integration_level(self) -> None:
+        # Mainline branch naming is a property of the org's repos, not of
+        # one capability, and ``capability_options`` only ever reach their
+        # own capability -- so it has to sit beside flavor/host where every
+        # capability can read it off ``ctx.integration_options``.
+        options = {opt.name: opt for opt in GitHubPlugin.manifest.options}
+        self.assertIn('mainline_branches', options)
+        self.assertEqual(options['mainline_branches'].default, 'main master')
+        self.assertFalse(options['mainline_branches'].required)
+        cap = GitHubPlugin.manifest.get_capability('deployment')
+        assert cap is not None
+        self.assertNotIn(
+            'mainline_branches', {opt.name for opt in cap.options}
+        )
+
     def test_no_legacy_deploys_via_edge_declared(self) -> None:
         # Promote behaviour is inferred from the ref shape and per-env
         # payloads ride on the USES edge (``env_payloads``).  No plugin
@@ -1309,6 +1325,238 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertTrue(all(e.release_notes is None for e in events))
         self.assertEqual(first.call_count, 1)
 
+    @respx.mock
+    async def test_branch_refs_never_reach_the_releases_api(self) -> None:
+        # A repo that deploys off its default branch reports ``ref ==
+        # 'main'``/``'master'``, which can never name a release.  Neither
+        # release route is mocked: if the lookup were attempted at all,
+        # respx would raise on the unmatched request.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 61,
+                        'sha': 'sha1',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    },
+                    {
+                        'id': 62,
+                        'sha': 'sha2',
+                        'ref': 'master',
+                        'created_at': '2026-05-13T14:05:00Z',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/61/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/62/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production'], limit=2
+        )
+        self.assertEqual(len(events), 2)
+        self.assertTrue(all(e.release_notes is None for e in events))
+
+    @respx.mock
+    async def test_configured_mainline_branches_retarget_the_guard(
+        self,
+    ) -> None:
+        # An org that deploys off ``develop`` configures it, which both
+        # suppresses the doomed ``develop`` lookup and re-enables the
+        # ``main`` one: the option replaces the default set, it doesn't
+        # extend it.  Only the ``main`` route is mocked, so respx raises
+        # if ``develop`` is looked up after all.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 91,
+                        'sha': 'sha1',
+                        'ref': 'develop',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    },
+                    {
+                        'id': 92,
+                        'sha': 'sha2',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:05:00Z',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/91/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/92/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        on_main = respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'tag_name': 'main', 'body': 'notes from main'}
+            )
+        )
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(
+                connection={
+                    'flavor': 'github',
+                    'mainline_branches': 'develop',
+                }
+            ),
+            _CREDS,
+            ['production'],
+            limit=2,
+        )
+        by_ref = {e.ref: e for e in events}
+        self.assertIsNone(by_ref['develop'].release_notes)
+        self.assertEqual(by_ref['main'].release_notes, 'notes from main')
+        self.assertEqual(on_main.call_count, 1)
+
+    @respx.mock
+    async def test_release_404_looked_up_once_per_sweep(self) -> None:
+        # Deployments sharing a tagless ref must pay for the miss once,
+        # not once per row -- and the memo is scoped to a single sweep,
+        # so a second call re-checks (a release may have been cut since).
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 71,
+                        'sha': 'sha1',
+                        'ref': 'release-candidate',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    },
+                    {
+                        'id': 72,
+                        'sha': 'sha2',
+                        'ref': 'release-candidate',
+                        'created_at': '2026-05-13T14:05:00Z',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/71/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/72/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        lookup = respx.get(
+            'https://api.github.com/repos/octo/demo/releases/'
+            'tags/release-candidate'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production'], limit=2
+        )
+        self.assertEqual(len(events), 2)
+        self.assertTrue(all(e.release_notes is None for e in events))
+        self.assertEqual(lookup.call_count, 1)
+        await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production'], limit=2
+        )
+        self.assertEqual(lookup.call_count, 2)
+
+    @respx.mock
+    async def test_release_410_cached_like_404(self) -> None:
+        # GitHub answers 410 Gone for a resource that's been disabled;
+        # treat it as a miss and suppress the repeat like a 404.
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 81,
+                        'sha': 'sha1',
+                        'ref': 'v3.0.0',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    },
+                    {
+                        'id': 82,
+                        'sha': 'sha2',
+                        'ref': 'v3.0.0',
+                        'created_at': '2026-05-13T14:05:00Z',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/81/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/82/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        lookup = respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/v3.0.0'
+        ).mock(return_value=httpx.Response(410, json={'message': 'Gone'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production'], limit=2
+        )
+        self.assertTrue(all(e.release_notes is None for e in events))
+        self.assertEqual(lookup.call_count, 1)
+
+    @respx.mock
+    async def test_release_404_coalesced_across_environments(self) -> None:
+        # The per-env fan-out is concurrent, so a memo of *results* would
+        # let every env past the check before the first response landed --
+        # exactly the shape at the host's default limit=1, where no single
+        # env repeats a ref and cross-env sharing is the only sharing
+        # there is. Two envs on one tagless ref must cost one lookup.
+        def _deployments(request: httpx.Request) -> httpx.Response:
+            deployment_id = {'staging': 61, 'production': 62}[
+                request.url.params['environment']
+            ]
+            return httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': deployment_id,
+                        'sha': f'sha{deployment_id}',
+                        'ref': 'release-candidate',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    }
+                ],
+            )
+
+        respx.get('https://api.github.com/repos/octo/demo/deployments').mock(
+            side_effect=_deployments
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/61/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/62/statuses'
+        ).mock(return_value=httpx.Response(200, json=[]))
+
+        async def _missing_release(request: httpx.Request) -> httpx.Response:
+            # Yield the way a real request does, so the second env gets a
+            # turn while the first one is still in flight.
+            await asyncio.sleep(0)
+            return httpx.Response(404, json={'message': 'Not Found'})
+
+        lookup = respx.get(
+            'https://api.github.com/repos/octo/demo/releases/'
+            'tags/release-candidate'
+        ).mock(side_effect=_missing_release)
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['staging', 'production'], limit=1
+        )
+        self.assertEqual(len(events), 2)
+        self.assertTrue(all(e.release_notes is None for e in events))
+        self.assertEqual(lookup.call_count, 1)
+
     @respx.mock
     async def test_bot_creator_attributed_to_triggering_actor(self) -> None:
         # A workflow-created deployment lists the app bot as creator; the
@@ -2185,6 +2433,53 @@ class RepoRootFromRedirectTestCase(unittest.TestCase):
         )
 
 
+class MainlineBranchesTestCase(unittest.TestCase):
+    def test_unset_falls_back_to_default(self) -> None:
+        self.assertEqual(
+            _mainline_branches({'flavor': 'github'}),
+            frozenset({'main', 'master'}),
+        )
+
+    def test_space_separated(self) -> None:
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': 'develop trunk'}),
+            frozenset({'develop', 'trunk'}),
+        )
+
+    def test_commas_tolerated(self) -> None:
+        # The label advertises spaces; operators type commas anyway.
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': 'main, develop,trunk'}),
+            frozenset({'main', 'develop', 'trunk'}),
+        )
+
+    def test_stray_separators_do_not_yield_empty_branch(self) -> None:
+        # An empty-string member would match a deployment with ``ref: ''``
+        # and, worse, read as a configured value.
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': '  main,, master,  '}),
+            frozenset({'main', 'master'}),
+        )
+
+    def test_blank_falls_back_to_default(self) -> None:
+        # The manifest default is a form pre-fill the host does not
+        # substitute, so blank means "unconfigured", not "no exclusions".
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': '   '}),
+            frozenset({'main', 'master'}),
+        )
+
+    def test_non_string_falls_back_to_default(self) -> None:
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': None}),
+            frozenset({'main', 'master'}),
+        )
+        self.assertEqual(
+            _mainline_branches({'mainline_branches': 7}),
+            frozenset({'main', 'master'}),
+        )
+
+
 class RepoRenameRelocationTestCase(unittest.IsolatedAsyncioTestCase):
     """A repo renamed outside Imbi: GitHub 301s the stale path to the
     by-id form.  The client follows it (request succeeds) and reports the