imbi-plugin-github 2.29.3__tar.gz → 2.29.4__tar.gz

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.29.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.29.3
+Version: 2.29.4
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.29.3
+Requires-Dist: imbi-common[databases]==2.29.4
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.29.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.29.3"
+version = "2.29.4"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.29.3",
+  "imbi-common[databases]==2.29.4",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.29.4}/src/imbi/plugins/github/deployment.py

@@ -506,6 +506,44 @@ def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     )
 
 
+def _latest_runs(
+    raw_runs: list[dict[str, typing.Any]],
+) -> list[dict[str, typing.Any]]:
+    """Collapse ``check_runs`` to the current run for each check.
+
+    GitHub keeps every historical run for a commit in the
+    ``/commits/{sha}/check-runs`` payload, so a workflow that failed and
+    was re-run to green reports both.  Rolling up that flat set pins the
+    commit at ``fail`` forever -- no re-run can ever clear it.
+
+    ``filter=latest`` does not help: it de-duplicates re-run *attempts*
+    within a single check suite, and a re-run dispatched as a fresh
+    workflow run gets a suite (and a check run) of its own.  The
+    de-duplication has to happen here.
+
+    Runs are keyed on ``(app.id, name)`` rather than ``name`` alone so
+    two apps publishing a same-named check stay distinct, and ordered by
+    check-run ``id``, which is monotonic at creation.  Timestamps are not
+    usable as a sort key -- skipped runs report ``completed_at`` earlier
+    than ``started_at``.  A run carrying no integer ``id`` cannot be
+    ordered against anything, so it is passed through untouched rather
+    than being discarded on a guess.
+    """
+    latest: dict[tuple[str, str], tuple[int, dict[str, typing.Any]]] = {}
+    unordered: list[dict[str, typing.Any]] = []
+    for run in raw_runs:
+        run_id = run.get('id')
+        if isinstance(run_id, bool) or not isinstance(run_id, int):
+            unordered.append(run)
+            continue
+        app: dict[str, typing.Any] = run.get('app') or {}
+        key = (str(app.get('id') or ''), str(run.get('name') or ''))
+        current = latest.get(key)
+        if current is None or run_id > current[0]:
+            latest[key] = (run_id, run)
+    return [run for _, run in latest.values()] + unordered
+
+
 def _check_runs_to_status(
     payload: dict[str, typing.Any],
 ) -> typing.Literal['pass', 'fail', 'warn', 'unknown']:
@@ -513,12 +551,17 @@ def _check_runs_to_status(
     raw_runs: list[dict[str, typing.Any]] = payload.get('check_runs') or []
     if not raw_runs:
         return 'unknown'
+    runs = _latest_runs(raw_runs)
     # Don't roll up while any run is still in flight — a mix of one
     # ``success`` and one ``in_progress`` would otherwise surface as
-    # ``pass`` because the in-progress conclusion is ``None``.
-    if any(str(run.get('status') or '') != 'completed' for run in raw_runs):
+    # ``pass`` because the in-progress conclusion is ``None``.  Scan only
+    # the surviving runs: a *superseded* run left non-terminal (a suite
+    # GitHub cancelled mid-flight, which happens in the wild) would
+    # otherwise pin the commit at ``unknown`` just as permanently as the
+    # stale ``failure`` pinned it at ``fail``.
+    if any(str(run.get('status') or '') != 'completed' for run in runs):
         return 'unknown'
-    conclusions = {str(run.get('conclusion') or '') for run in raw_runs}
+    conclusions = {str(run.get('conclusion') or '') for run in runs}
     failed = {'failure', 'timed_out', 'action_required'}
     if conclusions & failed:
         return 'fail'

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.29.4}/tests/test_commits.py

@@ -448,6 +448,39 @@ class SyncCommitsCiStatusTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual('pass', records[0].ci_status)
         self.assertEqual('fail', records[1].ci_status)
 
+    @respx.mock
+    async def test_rerun_to_green_syncs_as_pass(self) -> None:
+        # The sync path shares the deployment plugin's rollup, so it
+        # inherits the re-run de-duplication -- without it the API and
+        # the ClickHouse table agree with each other while both report a
+        # green commit as 'fail' (issue #282).
+        self._mock_compare('c' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'check_runs': [
+                        {
+                            'id': 1,
+                            'name': 'acceptance',
+                            'status': 'completed',
+                            'conclusion': 'failure',
+                            'app': {'id': 7},
+                        },
+                        {
+                            'id': 2,
+                            'name': 'acceptance',
+                            'status': 'completed',
+                            'conclusion': 'success',
+                            'app': {'id': 7},
+                        },
+                    ]
+                },
+            )
+        )
+        records = await self._run()
+        self.assertEqual('pass', records[0].ci_status)
+
     @respx.mock
     async def test_403_degrades_and_caches(self) -> None:
         self._mock_compare('c' * 40, 'd' * 40)

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.29.4}/tests/test_deployment.py

@@ -19,6 +19,7 @@ from imbi.plugins.github.deployment import (
     GitHubDeployment,
     _active_scan_limit,
     _artifact_status,
+    _check_runs_to_status,
     _mainline_branches,
     _repo_root_from_redirect,
 )
@@ -565,10 +566,17 @@ class CommitsTestCase(unittest.IsolatedAsyncioTestCase):
                 json={
                     'check_runs': [
                         {
+                            'id': 1,
+                            'name': 'unit',
                             'status': 'completed',
                             'conclusion': 'success',
                         },
-                        {'status': 'in_progress', 'conclusion': None},
+                        {
+                            'id': 2,
+                            'name': 'acceptance',
+                            'status': 'in_progress',
+                            'conclusion': None,
+                        },
                     ]
                 },
             )
@@ -2569,6 +2577,144 @@ class CheckStatusTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(status, 'unknown')
 
 
+def _run(
+    run_id: int,
+    conclusion: str | None,
+    *,
+    name: str = 'run / Run acceptance tests (testing)',
+    status: str = 'completed',
+    app_id: int = 15368,
+) -> dict[str, object]:
+    """One entry of a ``/check-runs`` payload."""
+    return {
+        'id': run_id,
+        'name': name,
+        'status': status,
+        'conclusion': conclusion,
+        'app': {'id': app_id},
+    }
+
+
+class CheckRunsRollupTestCase(unittest.TestCase):
+    """``_check_runs_to_status`` must judge a commit on its *current* runs.
+
+    GitHub returns every historical run for a commit, so a check that
+    failed and was re-run to green appears twice.  Rolling up the flat
+    set pinned such a commit at ``fail`` permanently -- see issue #282.
+    """
+
+    def test_superseded_failure_does_not_pin_fail(self) -> None:
+        # The reported case: two failures and a later success, all
+        # carrying the same check name.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'failure'),
+                    _run(2, 'failure'),
+                    _run(3, 'success'),
+                    _run(4, 'success', name='unit tests'),
+                    _run(5, 'skipped', name='deploy'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_latest_failure_still_fails(self) -> None:
+        # Don't over-correct: a check that went green and then red is
+        # red.  Payload order is deliberately not id order.
+        status = _check_runs_to_status(
+            {'check_runs': [_run(9, 'failure'), _run(3, 'success')]}
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_same_name_from_two_apps_is_not_collapsed(self) -> None:
+        # Two apps publishing a same-named check are distinct checks;
+        # collapsing them would hide the failing one.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'failure', app_id=111),
+                    _run(2, 'success', app_id=222),
+                ]
+            }
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_superseded_cancelled_does_not_warn(self) -> None:
+        # Cancel a hung job, re-run it green: the commit is green.
+        status = _check_runs_to_status(
+            {'check_runs': [_run(1, 'cancelled'), _run(2, 'success')]}
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_latest_cancelled_still_warns(self) -> None:
+        status = _check_runs_to_status(
+            {'check_runs': [_run(1, 'success'), _run(2, 'cancelled')]}
+        )
+        self.assertEqual(status, 'warn')
+
+    def test_superseded_in_flight_run_is_not_unknown(self) -> None:
+        # A suite GitHub cancelled mid-flight can be left non-terminal
+        # forever.  Only the current run's status gates the rollup --
+        # otherwise this trades a stuck ``fail`` for a stuck ``unknown``.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, None, status='queued'),
+                    _run(2, 'success'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_current_run_in_flight_is_unknown(self) -> None:
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'success'),
+                    _run(2, None, status='in_progress'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'unknown')
+
+    def test_ordering_ignores_timestamps(self) -> None:
+        # ``skipped`` runs report ``completed_at`` before ``started_at``,
+        # so only the monotonic ``id`` is a safe sort key.
+        older = _run(1, 'failure')
+        older.update(
+            {
+                'started_at': '2026-08-20T19:56:25Z',
+                'completed_at': '2026-08-20T19:58:00Z',
+            }
+        )
+        newer = _run(2, 'success')
+        newer.update(
+            {
+                'started_at': '2026-08-20T16:40:02Z',
+                'completed_at': '2026-08-20T16:38:51Z',
+            }
+        )
+        self.assertEqual(
+            _check_runs_to_status({'check_runs': [older, newer]}), 'pass'
+        )
+
+    def test_runs_without_ids_are_not_collapsed(self) -> None:
+        # Nothing orders these, so neither may be dropped on a guess.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    {'status': 'completed', 'conclusion': 'success'},
+                    {'status': 'completed', 'conclusion': 'failure'},
+                ]
+            }
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_empty_payload_is_unknown(self) -> None:
+        self.assertEqual(_check_runs_to_status({'check_runs': []}), 'unknown')
+
+
 class TagAndReleaseTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock
     async def test_create_tag_and_ref(self) -> None: