imbi-plugin-github 2.26.2__tar.gz → 2.28.0__tar.gz

{imbi_plugin_github-2.26.2 → imbi_plugin_github-2.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.26.2
+Version: 2.28.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.26.2
+Requires-Dist: imbi-common[databases]==2.28.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.26.2 → imbi_plugin_github-2.28.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.26.2"
+version = "2.28.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.26.2",
+  "imbi-common[databases]==2.28.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.26.2 → imbi_plugin_github-2.28.0}/src/imbi/plugins/github/deployment.py

@@ -1486,23 +1486,68 @@ class GitHubDeployment(DeploymentCapability):
 
         ``run_id`` is the GitHub deployment id returned by
         :meth:`trigger_deployment`.  GitHub returns status updates
-        newest-first; the latest entry wins.  An empty list means the
-        deploy workflow hasn't posted anything yet, which Imbi surfaces
-        as ``'queued'``.
-
-        ``log_url`` (and the legacy ``target_url``) on the latest status
-        is what the deploy workflow set to point at its own logs (e.g.
-        the Actions run URL).  We carry that as ``run_url`` so the UI
-        can deep-link without having to walk back to the workflow run
+        newest-first; the newest entry that describes this deployment's
+        own lifecycle wins.  An empty list means the deploy workflow
+        hasn't posted anything yet, which Imbi surfaces as ``'queued'``.
+
+        ``inactive`` entries are skipped rather than read as the answer.
+        Every other state is something this deployment's own run
+        reported about itself; ``inactive`` is written by GitHub *on
+        behalf of a later deployment* when that one supersedes this one.
+        Treating it as the outcome is wrong twice over: it relabels a
+        rollout that succeeded (the success is still in the list, one
+        entry further down), and its ``updated_at`` is the moment the
+        successor went live, so a caller stamping the close-out with
+        ``completed_at`` would date this deployment *after* the one that
+        replaced it.  That is what taught a production environment it
+        was running a release eleven days stale.
+
+        Note that ``inactive`` reaches Imbi only by polling -- here and
+        in :meth:`_latest_status`.  GitHub creates the status but emits no
+        ``deployment_status`` webhook for it, which its own docs state
+        outright: "A webhook event is not fired for deployment statuses
+        with an inactive state."  Confirmed 2026-08-21 against a repo
+        hook subscribed to ``*``, which saw the successor's ``success``
+        and nothing for the auto-inactive written in the same second.
+        So a poll is the only place the state can be handled correctly,
+        and there is no upstream fix to wait for.
+
+        Suppressing the state at source is not the alternative it looks
+        like: ``auto_inactive`` is documented as affecting only
+        "non-transient, non-production" deployments, yet the deployments
+        observed here carry ``production_environment=true`` and were
+        auto-inactivated anyway.  The documented carve-out does not
+        describe them, so setting ``auto_inactive=false`` would need an
+        experiment rather than a reading.
+
+        A deployment superseded while still in flight has no terminal
+        entry left once ``inactive`` is skipped, so it reads as whatever
+        it last genuinely reported and the sweeper expires it on age --
+        honest, because it never did finish.
+
+        ``log_url`` (and the legacy ``target_url``) on the selected
+        status is what the deploy workflow set to point at its own logs
+        (e.g. the Actions run URL).  We carry that as ``run_url`` so the
+        UI can deep-link without having to walk back to the workflow run
         through a check-suite join.
         """
         async with self._client(ctx, credentials) as client:
             resp = await client.get(f'/deployments/{run_id}/statuses')
             resp.raise_for_status()
             statuses = typing.cast(list[dict[str, typing.Any]], resp.json())
-            if not statuses:
+            latest = next(
+                (
+                    entry
+                    for entry in statuses
+                    if str(entry.get('state') or '').lower() != 'inactive'
+                ),
+                None,
+            )
+            if latest is None:
+                # Either nothing posted yet, or every entry is an
+                # auto-inactive -- both mean this deployment has told us
+                # nothing about itself.
                 return DeploymentRun(run_id=str(run_id), status='queued')
-            latest = statuses[0]
             state = str(latest.get('state') or '').lower()
             status: typing.Literal[
                 'queued',
@@ -1520,10 +1565,6 @@ class GitHubDeployment(DeploymentCapability):
                 status = 'success'
             elif state in {'failure', 'error'}:
                 status = 'failure'
-            elif state == 'inactive':
-                # Deployment was superseded by a newer one for the same
-                # env — Imbi treats that as cancelled rather than failed.
-                status = 'cancelled'
             else:
                 status = 'unknown'
             log_url = latest.get('log_url') or latest.get('target_url')
@@ -1906,11 +1947,32 @@ class GitHubDeployment(DeploymentCapability):
         not started, and ``pending`` is the host's vocabulary for
         both.  Network / parse errors degrade the same way so resync
         is never blocked by a single noisy row.
+
+        An ``inactive`` entry is looked *past* when something sits
+        beneath it.  GitHub writes one on a deployment when a later one
+        supersedes it, so it reports the successor's arrival rather than
+        this deployment's outcome -- and every deployment except an
+        environment's newest carries one.  Reading it verbatim therefore
+        relabelled whole deployment histories as ``rolled_back``, each
+        node's ``history`` showing the ``success`` it overwrote; ~14k
+        nodes in the production graph were in that state before this
+        skip existed.
+
+        An ``inactive`` with nothing beneath it still reports
+        ``rolled_back``: that deployment was superseded without ever
+        reporting on itself, and ``rolled_back`` is the accurate
+        terminal for it.  The distinction is the whole point -- skip the
+        retirement notice when it is hiding a real outcome, keep it when
+        it is the only thing we know.
+
+        This is why the page size is not 1.  A single-status window
+        cannot see past an ``inactive`` to the ``success`` underneath,
+        which is what made the misread unavoidable.
         """
         try:
             resp = await client.get(
                 f'/deployments/{deployment_id}/statuses',
-                params={'per_page': '1'},
+                params={'per_page': '10'},
             )
         except httpx.HTTPError:
             return 'pending', None
@@ -1922,7 +1984,14 @@ class GitHubDeployment(DeploymentCapability):
             return 'pending', None
         if not statuses:
             return 'pending', None
-        latest = statuses[0]
+        latest = next(
+            (
+                entry
+                for entry in statuses
+                if str(entry.get('state') or '').lower() != 'inactive'
+            ),
+            statuses[0],
+        )
         state = str(latest.get('state') or '').lower()
         log_url = latest.get('log_url') or latest.get('target_url')
         return _to_event_status(state), str(log_url) if log_url else None

{imbi_plugin_github-2.26.2 → imbi_plugin_github-2.28.0}/tests/test_deployment.py

@@ -905,20 +905,60 @@ class GetDeploymentStatusTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(run.status, 'failure')
 
     @respx.mock
-    async def test_status_inactive_maps_to_cancelled(self) -> None:
-        # ``inactive`` means a newer deployment for the same env
-        # superseded this one — Imbi treats it as cancelled, not failed.
+    async def test_status_skips_inactive_to_the_real_outcome(self) -> None:
+        """``inactive`` hides the success it was written on top of.
+
+        GitHub stamps ``inactive`` on a deployment when a *later* one
+        supersedes it, so it is newest-first but describes the wrong
+        rollout.  Reading it as the answer relabelled a succeeded
+        deployment as cancelled -> failed, and -- worse -- carried the
+        successor's ``updated_at`` as this deployment's completion, so
+        the close-out sorted after the release that replaced it.
+        """
         respx.get(
             'https://api.github.com/repos/octo/demo/deployments/42/statuses'
         ).mock(
             return_value=httpx.Response(
                 200,
-                json=[{'state': 'inactive'}],
+                json=[
+                    {
+                        'state': 'inactive',
+                        'created_at': '2026-08-14T19:51:26Z',
+                        'updated_at': '2026-08-14T19:51:26Z',
+                        'log_url': 'https://gh/runs/stale',
+                    },
+                    {
+                        'state': 'success',
+                        'created_at': '2026-08-03T19:03:32Z',
+                        'updated_at': '2026-08-03T19:03:32Z',
+                        'log_url': 'https://gh/runs/real',
+                    },
+                    {'state': 'in_progress'},
+                ],
             )
         )
         plugin = GitHubDeployment()
         run = await plugin.get_deployment_status(_ctx(), _CREDS, '42')
-        self.assertEqual(run.status, 'cancelled')
+        self.assertEqual(run.status, 'success')
+        self.assertEqual(run.run_url, 'https://gh/runs/real')
+        assert run.completed_at is not None
+        self.assertEqual(
+            datetime.datetime(2026, 8, 3, 19, 3, 32, tzinfo=datetime.UTC),
+            run.completed_at,
+        )
+
+    @respx.mock
+    async def test_status_only_inactive_reads_as_queued(self) -> None:
+        # Superseded without ever reporting on itself: there is no
+        # outcome to read, so it stays unresolved and the sweeper
+        # expires it on age rather than inventing a terminal status.
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/42/statuses'
+        ).mock(return_value=httpx.Response(200, json=[{'state': 'inactive'}]))
+        plugin = GitHubDeployment()
+        run = await plugin.get_deployment_status(_ctx(), _CREDS, '42')
+        self.assertEqual(run.status, 'queued')
+        self.assertIsNone(run.completed_at)
 
 
 class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
@@ -975,6 +1015,63 @@ class ListRecentDeploymentsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(len(events), 1)
         self.assertEqual(events[0].sha, 'appsha')
 
+    @respx.mock
+    async def test_resync_skips_inactive_to_the_real_outcome(self) -> None:
+        """Resync must not relabel deployment history as rolled_back.
+
+        Every deployment except an environment's newest carries an
+        ``inactive`` status, written when its successor went live.
+        Reading the newest entry verbatim turned each of them into
+        ``rolled_back``, overwriting the ``success`` directly beneath
+        it -- ~14k nodes in the production graph, whose ``history``
+        records the success-then-rolled_back flip.
+        """
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments',
+            params={'environment': 'production', 'per_page': '1'},
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'id': 55,
+                        'sha': 'deadbeef',
+                        'ref': 'main',
+                        'created_at': '2026-05-13T14:00:00Z',
+                    }
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/deployments/55/statuses'
+        ).mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {
+                        'state': 'inactive',
+                        'created_at': '2026-05-20T09:00:00Z',
+                        'log_url': 'https://gh/runs/successor',
+                    },
+                    {
+                        'state': 'success',
+                        'created_at': '2026-05-13T14:01:00Z',
+                        'log_url': 'https://gh/runs/real',
+                    },
+                ],
+            )
+        )
+        respx.get(
+            'https://api.github.com/repos/octo/demo/releases/tags/main'
+        ).mock(return_value=httpx.Response(404, json={'message': 'Not Found'}))
+        plugin = GitHubDeployment()
+        events = await plugin.list_recent_deployments(
+            _ctx(), _CREDS, ['production']
+        )
+        self.assertEqual(len(events), 1)
+        self.assertEqual(events[0].status, 'success')
+        self.assertEqual(events[0].run_url, 'https://gh/runs/real')
+
     @respx.mock
     async def test_one_env_one_deployment_success(self) -> None:
         respx.get(