imbi-plugin-github 2.25.0__tar.gz → 2.26.0__tar.gz

{imbi_plugin_github-2.25.0 → imbi_plugin_github-2.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.25.0
+Version: 2.26.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.25.0
+Requires-Dist: imbi-common[databases]==2.26.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.25.0 → imbi_plugin_github-2.26.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.25.0"
+version = "2.26.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.25.0",
+  "imbi-common[databases]==2.26.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.25.0 → imbi_plugin_github-2.26.0}/src/imbi/plugins/github/deployment.py

@@ -32,6 +32,7 @@ access token through the Integration credential blob's
 from __future__ import annotations
 
 import asyncio
+import base64
 import collections.abc
 import contextlib
 import datetime
@@ -139,6 +140,31 @@ def _auth_headers(token: str) -> dict[str, str]:
     }
 
 
+#: A push event's ``before`` when the ref did not exist until now.
+_ZERO_SHA = '0' * 40
+# GitHub's compare endpoint lists at most 300 changed files and offers
+# no pagination for them -- a list this long may be incomplete.
+_COMPARE_FILES_CAP = 300
+# How many note-blob reads run at once when listing a whole notes tree.
+_NOTE_BLOB_CONCURRENCY = 10
+
+_FULL_SHA_PATTERN = re.compile(r'^[0-9a-f]{40}$')
+
+
+def _note_sha(path: object) -> str | None:
+    """Annotated commit SHA for a notes-tree path, or ``None``.
+
+    Notes trees key blobs by the annotated commit's full SHA, optionally
+    fanned out into subtrees (``ab/cdef...``); flattening the path
+    recovers the SHA.  Non-note files (``README`` and friends can live
+    on a notes ref) do not flatten to 40 hex chars and are skipped.
+    """
+    if not isinstance(path, str):
+        return None
+    flattened = path.replace('/', '').lower()
+    return flattened if _FULL_SHA_PATTERN.match(flattened) else None
+
+
 def _short_sha(sha: str) -> str:
     return sha[:7]
 
@@ -414,11 +440,12 @@ def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     commit_meta: dict[str, typing.Any] = payload.get('commit') or {}
     author_meta: dict[str, typing.Any] = commit_meta.get('author') or {}
     raw_message = str(commit_meta.get('message') or '')
-    message_lines = raw_message.splitlines()
+    subject, _, body = raw_message.partition('\n')
     return Commit(
         sha=sha,
         short_sha=_short_sha(sha),
-        message=message_lines[0] if message_lines else '',
+        message=subject,
+        body=body.strip() or None,
         author=author_meta.get('name'),
         authored_at=_parse_iso(author_meta.get('date')),
         url=payload.get('html_url'),
@@ -848,6 +875,238 @@ class GitHubDeployment(DeploymentCapability):
                 deletions=deletions,
             )
 
+    # -- Git notes ----------------------------------------------------------
+
+    async def get_commit_note(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        namespace: str,
+        committish: str,
+    ) -> str | None:
+        """Read the note on ``committish`` from ``refs/notes/<namespace>``.
+
+        The notes tree keys blobs by the *full* SHA of the annotated
+        commit (with optional fan-out subtrees like ``ab/cdef...``), so a
+        short committish is resolved through the commits endpoint first.
+        """
+        async with self._client(ctx, credentials) as client:
+            full_sha = committish.lower()
+            if not _FULL_SHA_PATTERN.match(full_sha):
+                commit = await client.get(
+                    f'/commits/{urllib.parse.quote(committish, safe="")}'
+                )
+                commit.raise_for_status()
+                full_sha = str(commit.json()['sha']).lower()
+            notes = await self._notes_tree(client, namespace)
+            if notes is None:
+                return None
+            blob_sha = notes.get(full_sha)
+            if blob_sha is None:
+                return None
+            return await self._blob_text(client, blob_sha)
+
+    async def diff_commit_notes(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        namespace: str,
+        before: str,
+        after: str,
+    ) -> dict[str, str | None]:
+        """Diff ``refs/notes/<namespace>`` between two of its commits.
+
+        ``before``/``after`` come from a push event on the notes ref;
+        the *files* changed between them are the notes of the annotated
+        commits, so the tree diff -- not the push's ``commits`` list --
+        is what names the commits whose notes changed.  An all-zero
+        ``before`` (the ref was just created) returns every note at
+        ``after``.
+
+        Known limitation: GitHub's compare endpoint is three-dot only
+        (``after`` against the merge base), so a *force-pushed* notes
+        ref whose ``before`` is not an ancestor of ``after`` can miss a
+        note that the rewrite flipped or removed.  The 404 fallback
+        below covers a ``before`` GitHub no longer has at all, and the
+        sweep backfill only repairs verdicts that are still ``null`` --
+        a stale non-null verdict from this window persists until the
+        next ordinary push touches the note.
+        """
+        async with self._client(ctx, credentials) as client:
+            if before == _ZERO_SHA:
+                return await self._all_notes(client, after)
+            quoted = urllib.parse.quote(f'{before}...{after}', safe='.')
+            resp = await client.get(f'/compare/{quoted}')
+            if resp.status_code == 404:
+                # ``before`` was garbage-collected or the ref history
+                # was rewritten; fall back to the full tree at ``after``
+                # so the push still lands rather than being dropped.
+                return await self._all_notes(client, after)
+            resp.raise_for_status()
+            payload = typing.cast('dict[str, typing.Any]', resp.json())
+            files: list[dict[str, typing.Any]] = payload.get('files') or []
+            if len(files) >= _COMPARE_FILES_CAP:
+                # The compare endpoint stops listing files at 300 and
+                # offers no pagination for them, so a full list this
+                # long may be missing entries.  Fall back to the whole
+                # tree at ``after`` -- same trade-off as the 404 path:
+                # removals in the window are missed until the sweep or
+                # the next push touches them.
+                LOGGER.warning(
+                    'Notes compare %s...%s hit the %d-file cap; '
+                    'reading the full tree instead',
+                    before,
+                    after,
+                    _COMPARE_FILES_CAP,
+                )
+                return await self._all_notes(client, after)
+            out: dict[str, str | None] = {}
+            for item in files:
+                status = str(item.get('status') or '')
+                previous = _note_sha(item.get('previous_filename'))
+                if status == 'renamed' and previous is not None:
+                    # Fan-out reshuffle: the note moved paths.  The old
+                    # path's flattened SHA only differs from the new one
+                    # if the note now annotates a different commit.
+                    out.setdefault(previous, None)
+                annotated = _note_sha(item.get('filename'))
+                if annotated is None:
+                    continue
+                if status == 'removed':
+                    out[annotated] = None
+                    continue
+                blob_sha = item.get('sha')
+                if not blob_sha:
+                    continue
+                try:
+                    body = await self._blob_text(client, str(blob_sha))
+                except httpx.HTTPError:
+                    LOGGER.warning(
+                        'Could not read note blob %s for %s; skipping',
+                        blob_sha,
+                        annotated,
+                    )
+                    body = None
+                if body is None:
+                    # Skip rather than record ``None``: in the diff a
+                    # ``None`` means "note removed" and would resolve a
+                    # drift blocker over a note we merely could not
+                    # read (``_blob_text`` already logged why).
+                    out.pop(annotated, None)
+                    continue
+                out[annotated] = body
+            return out
+
+    async def _notes_tree(
+        self, client: httpx.AsyncClient, namespace: str
+    ) -> dict[str, str] | None:
+        """Map annotated full SHA -> note blob SHA, or ``None`` sans ref."""
+        ref = await client.get(
+            f'/git/ref/{urllib.parse.quote(f"notes/{namespace}", safe="/")}'
+        )
+        if ref.status_code == 404:
+            return None
+        ref.raise_for_status()
+        tip = str(ref.json()['object']['sha'])
+        return await self._tree_notes(client, tip)
+
+    async def _tree_notes(
+        self, client: httpx.AsyncClient, commit_sha: str
+    ) -> dict[str, str]:
+        """Flatten one notes-ref commit's tree to annotated SHA -> blob."""
+        commit = await client.get(f'/git/commits/{commit_sha}')
+        commit.raise_for_status()
+        tree_sha = str(commit.json()['tree']['sha'])
+        tree = await client.get(f'/git/trees/{tree_sha}?recursive=1')
+        tree.raise_for_status()
+        payload = typing.cast('dict[str, typing.Any]', tree.json())
+        if payload.get('truncated'):
+            LOGGER.warning(
+                'Notes tree %s is truncated; some notes will be missed',
+                tree_sha,
+            )
+        entries: list[dict[str, typing.Any]] = payload.get('tree') or []
+        out: dict[str, str] = {}
+        for entry in entries:
+            if entry.get('type') != 'blob':
+                continue
+            annotated = _note_sha(entry.get('path'))
+            if annotated is not None:
+                out[annotated] = str(entry['sha'])
+        return out
+
+    async def _all_notes(
+        self, client: httpx.AsyncClient, commit_sha: str
+    ) -> dict[str, str | None]:
+        """Every note at one notes-ref commit, bodies included.
+
+        Blob reads run a few at a time (one request per note) and an
+        unreadable note is skipped rather than failing the batch or
+        recording a false "removed".
+        """
+        notes = await self._tree_notes(client, commit_sha)
+        gate = asyncio.Semaphore(_NOTE_BLOB_CONCURRENCY)
+
+        async def _read(blob_sha: str) -> str | BaseException | None:
+            async with gate:
+                try:
+                    return await self._blob_text(client, blob_sha)
+                except httpx.HTTPError as exc:
+                    return exc
+
+        items = list(notes.items())
+        bodies = await asyncio.gather(
+            *(_read(blob_sha) for _, blob_sha in items)
+        )
+        out: dict[str, str | None] = {}
+        for (annotated, blob_sha), body in zip(items, bodies, strict=True):
+            if isinstance(body, BaseException):
+                LOGGER.warning(
+                    'Could not read note blob %s for %s; skipping',
+                    blob_sha,
+                    annotated,
+                )
+                continue
+            if body is None:
+                # ``_blob_text`` could not decode it and logged why;
+                # a ``None`` here would read as "note removed".
+                continue
+            out[annotated] = body
+        return out
+
+    @staticmethod
+    async def _blob_text(
+        client: httpx.AsyncClient, blob_sha: str
+    ) -> str | None:
+        """Fetch and decode one note blob; ``None`` when undecodable."""
+        resp = await client.get(f'/git/blobs/{blob_sha}')
+        resp.raise_for_status()
+        payload = typing.cast('dict[str, typing.Any]', resp.json())
+        content = str(payload.get('content') or '')
+        if payload.get('encoding') != 'base64':
+            if not content:
+                # ``encoding: none`` with an empty body is how GitHub
+                # answers for blobs above the inline size limit --
+                # "cannot read", not "empty note".
+                LOGGER.warning(
+                    'Note blob %s answered encoding %r with no content',
+                    blob_sha,
+                    payload.get('encoding'),
+                )
+                return None
+            return content
+        try:
+            # Strip GitHub's line wrapping, then decode strictly --
+            # the default decoder silently discards invalid characters,
+            # turning garbage like '%%%%' into an empty body instead of
+            # landing on this "cannot read" path.
+            return base64.b64decode(
+                ''.join(content.split()), validate=True
+            ).decode('utf-8')
+        except (ValueError, UnicodeDecodeError):
+            LOGGER.warning('Could not decode note blob %s', blob_sha)
+            return None
+
     # -- Tags / Releases ----------------------------------------------------
 
     async def create_tag(

{imbi_plugin_github-2.25.0 → imbi_plugin_github-2.26.0}/tests/test_deployment.py

@@ -1,6 +1,7 @@
 """Smoke tests for the GitHub deployment capability handler."""
 
 import asyncio
+import base64
 import datetime
 import json
 import time
@@ -642,6 +643,44 @@ class CompareTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(result.head_sha, 'c2')
         self.assertEqual(result.base_sha, 'base-sha')
 
+    @respx.mock
+    async def test_compare_splits_subject_from_body(self) -> None:
+        respx.get(
+            'https://api.github.com/repos/octo/demo/compare/base...head'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'commits': [
+                        {
+                            'sha': 'c1',
+                            'commit': {
+                                'message': 'Add widgets (#8)\n\n## Summary\n'
+                                'Adds the widget endpoint.\n',
+                                'author': {'name': 'A', 'date': None},
+                            },
+                        },
+                        {
+                            'sha': 'c2',
+                            'commit': {
+                                'message': 'Subject only',
+                                'author': {'name': 'A', 'date': None},
+                            },
+                        },
+                    ],
+                },
+            )
+        )
+        plugin = GitHubDeployment()
+        result = await plugin.compare(_ctx(), _CREDS, 'base', 'head')
+        self.assertEqual(result.commits[0].message, 'Add widgets (#8)')
+        self.assertEqual(
+            result.commits[0].body,
+            '## Summary\nAdds the widget endpoint.',
+        )
+        self.assertEqual(result.commits[1].message, 'Subject only')
+        self.assertIsNone(result.commits[1].body)
+
 
 class TriggerDeploymentTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock
@@ -2614,3 +2653,388 @@ class RepoRenameRelocationTestCase(unittest.IsolatedAsyncioTestCase):
         plugin = GitHubDeployment()
         await plugin.list_commits(ctx, _CREDS, ref='main')
         self.assertIsNone(ctx.link_writeback)
+
+
+class GitNotesTestCase(unittest.IsolatedAsyncioTestCase):
+    """Reading and diffing ``refs/notes/imbi-drift`` via the Git Data API."""
+
+    REPO = 'https://api.github.com/repos/octo/demo'
+    FULL_SHA = 'abc1234' + 'f' * 33
+
+    def setUp(self) -> None:
+        self.handler = GitHubDeployment()
+
+    def _mock_tree(self, entries: list[dict[str, object]]) -> None:
+        respx.get(f'{self.REPO}/git/ref/notes/imbi-drift').mock(
+            return_value=httpx.Response(
+                200, json={'object': {'sha': 'notes-tip'}}
+            )
+        )
+        respx.get(f'{self.REPO}/git/commits/notes-tip').mock(
+            return_value=httpx.Response(200, json={'tree': {'sha': 't1'}})
+        )
+        respx.get(f'{self.REPO}/git/trees/t1').mock(
+            return_value=httpx.Response(200, json={'tree': entries})
+        )
+
+    @staticmethod
+    def _blob(sha: str, text: str) -> None:
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/git/blobs/{sha}'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'encoding': 'base64',
+                    'content': base64.b64encode(text.encode()).decode(),
+                },
+            )
+        )
+
+    @respx.mock
+    async def test_get_commit_note_resolves_short_sha_and_fanout(
+        self,
+    ) -> None:
+        respx.get(f'{self.REPO}/commits/abc1234').mock(
+            return_value=httpx.Response(200, json={'sha': self.FULL_SHA})
+        )
+        fanout = f'{self.FULL_SHA[:2]}/{self.FULL_SHA[2:]}'
+        self._mock_tree([{'type': 'blob', 'path': fanout, 'sha': 'b1'}])
+        self._blob('b1', '{"drift_detected":false}')
+        note = await self.handler.get_commit_note(
+            _ctx(), _CREDS, 'imbi-drift', 'abc1234'
+        )
+        self.assertEqual('{"drift_detected":false}', note)
+
+    @respx.mock
+    async def test_get_commit_note_missing_ref_is_none(self) -> None:
+        respx.get(f'{self.REPO}/git/ref/notes/imbi-drift').mock(
+            return_value=httpx.Response(404, json={'message': 'Not Found'})
+        )
+        note = await self.handler.get_commit_note(
+            _ctx(), _CREDS, 'imbi-drift', self.FULL_SHA
+        )
+        self.assertIsNone(note)
+
+    @respx.mock
+    async def test_get_commit_note_no_entry_is_none(self) -> None:
+        self._mock_tree([{'type': 'blob', 'path': 'e' * 40, 'sha': 'b1'}])
+        note = await self.handler.get_commit_note(
+            _ctx(), _CREDS, 'imbi-drift', self.FULL_SHA
+        )
+        self.assertIsNone(note)
+
+    @respx.mock
+    async def test_diff_commit_notes_reads_the_tree_diff(self) -> None:
+        removed_sha = 'e' * 40
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'files': [
+                        {
+                            'filename': (
+                                f'{self.FULL_SHA[:2]}/{self.FULL_SHA[2:]}'
+                            ),
+                            'status': 'modified',
+                            'sha': 'b2',
+                        },
+                        {'filename': removed_sha, 'status': 'removed'},
+                        {'filename': 'README', 'status': 'added'},
+                    ]
+                },
+            )
+        )
+        self._blob('b2', '{"drift_detected":true}')
+        changed = await self.handler.diff_commit_notes(
+            _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+        )
+        self.assertEqual(
+            {
+                self.FULL_SHA: '{"drift_detected":true}',
+                removed_sha: None,
+            },
+            changed,
+        )
+
+    def _mock_after_tree(
+        self, entries: list[dict[str, object]] | None = None
+    ) -> None:
+        """The full tree at ``after`` the fallback paths read."""
+        respx.get(f'{self.REPO}/git/commits/{"b" * 40}').mock(
+            return_value=httpx.Response(200, json={'tree': {'sha': 't1'}})
+        )
+        respx.get(f'{self.REPO}/git/trees/t1').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'tree': entries
+                    or [{'type': 'blob', 'path': self.FULL_SHA, 'sha': 'b1'}]
+                },
+            )
+        )
+
+    @respx.mock
+    async def test_diff_commit_notes_tracks_a_renamed_note(self) -> None:
+        old_sha = 'e' * 40
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'files': [
+                        {
+                            'filename': (
+                                f'{self.FULL_SHA[:2]}/{self.FULL_SHA[2:]}'
+                            ),
+                            'previous_filename': old_sha,
+                            'status': 'renamed',
+                            'sha': 'b2',
+                        }
+                    ]
+                },
+            )
+        )
+        self._blob('b2', '{"drift_detected":true}')
+        changed = await self.handler.diff_commit_notes(
+            _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+        )
+        self.assertEqual(
+            {
+                self.FULL_SHA: '{"drift_detected":true}',
+                old_sha: None,
+            },
+            changed,
+        )
+
+    @respx.mock
+    async def test_diff_commit_notes_404_falls_back_to_the_tree(
+        self,
+    ) -> None:
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(404, json={'message': 'Not Found'})
+        )
+        self._mock_after_tree()
+        self._blob('b1', '{"drift_detected":false}')
+        changed = await self.handler.diff_commit_notes(
+            _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+        )
+        self.assertEqual({self.FULL_SHA: '{"drift_detected":false}'}, changed)
+
+    @respx.mock
+    async def test_diff_commit_notes_file_cap_falls_back_to_the_tree(
+        self,
+    ) -> None:
+        # 300 files means the unpaginated list may be incomplete.
+        files = [
+            {'filename': f'{i:040x}', 'status': 'added', 'sha': f's{i}'}
+            for i in range(300)
+        ]
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(200, json={'files': files})
+        )
+        self._mock_after_tree()
+        self._blob('b1', '{"drift_detected":false}')
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+            )
+        self.assertEqual({self.FULL_SHA: '{"drift_detected":false}'}, changed)
+
+    @respx.mock
+    async def test_diff_commit_notes_skips_an_unreadable_blob(self) -> None:
+        # A failed read is skipped, not recorded as ``None`` -- in the
+        # diff a ``None`` means "note removed" and resolves blockers.
+        other_sha = 'e' * 40
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'files': [
+                        {
+                            'filename': self.FULL_SHA,
+                            'status': 'modified',
+                            'sha': 'bad',
+                        },
+                        {
+                            'filename': other_sha,
+                            'status': 'modified',
+                            'sha': 'b2',
+                        },
+                    ]
+                },
+            )
+        )
+        respx.get(f'{self.REPO}/git/blobs/bad').mock(
+            return_value=httpx.Response(500)
+        )
+        self._blob('b2', '{"drift_detected":true}')
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+            )
+        self.assertEqual({other_sha: '{"drift_detected":true}'}, changed)
+
+    @respx.mock
+    async def test_undecodable_blob_is_skipped(self) -> None:
+        # Not recorded as ``None``: in the diff a ``None`` means "note
+        # removed" and would resolve a drift blocker over a note that
+        # merely could not be decoded.
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'files': [
+                        {
+                            'filename': self.FULL_SHA,
+                            'status': 'modified',
+                            'sha': 'b2',
+                        }
+                    ]
+                },
+            )
+        )
+        respx.get(f'{self.REPO}/git/blobs/b2').mock(
+            return_value=httpx.Response(
+                200,
+                json={'encoding': 'base64', 'content': '%%%not-base64%%%'},
+            )
+        )
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+            )
+        self.assertEqual({}, changed)
+
+    @respx.mock
+    async def test_garbage_base64_is_skipped_not_read_as_empty(self) -> None:
+        # The default decoder discards invalid characters, so '%%%%'
+        # would decode to an empty body and stamp a null verdict
+        # instead of landing on the "cannot read" skip path.
+        respx.get(f'{self.REPO}/compare/{"a" * 40}...{"b" * 40}').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'files': [
+                        {
+                            'filename': self.FULL_SHA,
+                            'status': 'modified',
+                            'sha': 'b2',
+                        }
+                    ]
+                },
+            )
+        )
+        respx.get(f'{self.REPO}/git/blobs/b2').mock(
+            return_value=httpx.Response(
+                200, json={'encoding': 'base64', 'content': '%%%%'}
+            )
+        )
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', 'a' * 40, 'b' * 40
+            )
+        self.assertEqual({}, changed)
+
+    @respx.mock
+    async def test_line_wrapped_base64_still_decodes(self) -> None:
+        # GitHub wraps blob content in newlines; strict validation must
+        # not reject its own wrapping.
+        fanout = f'{self.FULL_SHA[:2]}/{self.FULL_SHA[2:]}'
+        self._mock_tree([{'type': 'blob', 'path': fanout, 'sha': 'b1'}])
+        encoded = base64.b64encode(b'{"drift_detected":true}').decode()
+        wrapped = f'{encoded[:16]}\n{encoded[16:]}\n'
+        respx.get(f'{self.REPO}/git/blobs/b1').mock(
+            return_value=httpx.Response(
+                200, json={'encoding': 'base64', 'content': wrapped}
+            )
+        )
+        note = await self.handler.get_commit_note(
+            _ctx(), _CREDS, 'imbi-drift', self.FULL_SHA
+        )
+        self.assertEqual('{"drift_detected":true}', note)
+
+    @respx.mock
+    async def test_undecodable_blob_is_skipped_in_the_full_tree(
+        self,
+    ) -> None:
+        other_sha = 'e' * 40
+        self._mock_after_tree(
+            [
+                {'type': 'blob', 'path': self.FULL_SHA, 'sha': 'b2'},
+                {'type': 'blob', 'path': other_sha, 'sha': 'b3'},
+            ]
+        )
+        respx.get(f'{self.REPO}/git/blobs/b2').mock(
+            return_value=httpx.Response(
+                200,
+                json={'encoding': 'base64', 'content': '%%%not-base64%%%'},
+            )
+        )
+        self._blob('b3', '{"drift_detected":false}')
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', '0' * 40, 'b' * 40
+            )
+        self.assertEqual({other_sha: '{"drift_detected":false}'}, changed)
+
+    @respx.mock
+    async def test_oversized_blob_is_none(self) -> None:
+        # ``encoding: none`` with empty content is GitHub's answer for
+        # blobs above the inline size limit -- "cannot read", not an
+        # empty note.
+        self._mock_tree(
+            [{'type': 'blob', 'path': self.FULL_SHA, 'sha': 'big'}]
+        )
+        respx.get(f'{self.REPO}/git/blobs/big').mock(
+            return_value=httpx.Response(
+                200, json={'encoding': 'none', 'content': ''}
+            )
+        )
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            note = await self.handler.get_commit_note(
+                _ctx(), _CREDS, 'imbi-drift', self.FULL_SHA
+            )
+        self.assertIsNone(note)
+
+    @respx.mock
+    async def test_all_notes_skips_an_unreadable_blob(self) -> None:
+        other_sha = 'e' * 40
+        self._mock_after_tree(
+            [
+                {'type': 'blob', 'path': self.FULL_SHA, 'sha': 'bad'},
+                {'type': 'blob', 'path': other_sha, 'sha': 'b2'},
+            ]
+        )
+        respx.get(f'{self.REPO}/git/blobs/bad').mock(
+            return_value=httpx.Response(500)
+        )
+        self._blob('b2', '{"drift_detected":false}')
+        with self.assertLogs('imbi.plugins.github', level='WARNING'):
+            changed = await self.handler.diff_commit_notes(
+                _ctx(), _CREDS, 'imbi-drift', '0' * 40, 'b' * 40
+            )
+        self.assertEqual({other_sha: '{"drift_detected":false}'}, changed)
+
+    @respx.mock
+    async def test_diff_commit_notes_zero_before_lists_everything(
+        self,
+    ) -> None:
+        respx.get(f'{self.REPO}/git/commits/{"b" * 40}').mock(
+            return_value=httpx.Response(200, json={'tree': {'sha': 't1'}})
+        )
+        respx.get(f'{self.REPO}/git/trees/t1').mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'tree': [
+                        {'type': 'blob', 'path': self.FULL_SHA, 'sha': 'b1'},
+                        {'type': 'tree', 'path': 'ab', 'sha': 'sub'},
+                    ]
+                },
+            )
+        )
+        self._blob('b1', '{"drift_detected":false}')
+        changed = await self.handler.diff_commit_notes(
+            _ctx(), _CREDS, 'imbi-drift', '0' * 40, 'b' * 40
+        )
+        self.assertEqual({self.FULL_SHA: '{"drift_detected":false}'}, changed)