imbi-plugin-github 2.29.3__tar.gz → 2.30.0__tar.gz

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.29.3
+Version: 2.30.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.29.3
+Requires-Dist: imbi-common[databases]==2.30.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.29.3"
+version = "2.30.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.29.3",
+  "imbi-common[databases]==2.30.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/src/imbi/plugins/github/commits.py

@@ -85,11 +85,24 @@ _MAX_HISTORY_PAGES = 100
 # ``_MAX_HISTORY_PAGES``: this path exists to pick up the handful of
 # commits a release build pushed, not to stand in for a full backfill.
 _MAX_SINCE_PAGES = 10
-# CI status is hydrated with one ``/check-runs`` call per commit, which is
-# prohibitively expensive across a full-history backfill.  Bound it to the
-# most-recent commits (the only ones whose CI is still meaningful and
-# unexpired); older commits keep the ``'unknown'`` default.
-_BACKFILL_CI_LIMIT = 25
+# CI status is hydrated with one ``/check-runs`` call per commit (more
+# when it pages), which is prohibitively expensive across a full-history
+# backfill.  Bound it to the most-recent commits; older commits keep the
+# ``'unknown'`` default.
+#
+# 200 is where the gap actually closes -- the ``recent-commits`` endpoint
+# caps ``limit`` at 200 and the deployments tab asks for exactly that
+# (``COMMIT_WINDOW``), so hydrating past 200 cannot change what a reader
+# sees.  This deliberately stops at half of it: backfills are already
+# slow, and every commit here costs at least one ``/check-runs`` call, so
+# 25 -> 200 would have octupled the request count in one step.  100 buys
+# most of the visible window at 4x rather than 8x; rows 100-199 keep the
+# ``'unknown'`` default until this is raised or made configurable.
+_BACKFILL_CI_LIMIT = 100
+# Pages of ``/check-runs`` to walk per commit before giving up.  100 per
+# page * 5 = 500 runs, well past the busiest observed commit (50), so the
+# cap only bounds a pathological repo rather than shaping normal reads.
+_MAX_CHECK_RUN_PAGES = 5
 # Page size for ``sync_new_commits``' last-resort walk, used when nothing
 # is stored *and* no ``since`` was supplied. Sized to cover a release
 # build's handful of pushed commits, not to approximate a backfill.
@@ -577,6 +590,29 @@ async def _fetch_recent_commits(
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
 
 
+async def _fetch_single_commit(
+    client: httpx.AsyncClient, sha: str, *, max_wait: float
+) -> list[dict[str, typing.Any]]:
+    """``GET /commits/{sha}`` as a one-item list, ``[]`` when absent.
+
+    For a delivery that names a head commit but carries no previous
+    head -- a ``workflow_run`` / ``check_suite`` style event rather than
+    a ``push`` -- the only commit the payload attests to is *sha*
+    itself.  The response shape matches a ``commits[]`` entry from the
+    compare API, so :func:`_commit_record` maps it unchanged and the
+    caller's CI hydration and author resolution work on the list as-is.
+    """
+    resp = await _request(client, 'GET', f'/commits/{sha}', max_wait=max_wait)
+    if resp.status_code == 404:
+        LOGGER.warning(
+            'github-commit-sync: commit %s not found; nothing to sync',
+            _short_sha(sha),
+        )
+        return []
+    resp.raise_for_status()
+    return [typing.cast('dict[str, typing.Any]', resp.json())]
+
+
 async def _ci_status(
     client: httpx.AsyncClient,
     sha: str,
@@ -595,22 +631,54 @@ async def _ci_status(
     non-200, a parse error, a network error, or a rate-limit pause -- CI
     status is best-effort metadata and must never fail the sync, mirroring
     the swallow-and-continue contract the rest of this module follows.
+
+    The whole run set has to be in hand before rolling up, so this pages
+    to the end rather than reading the first page: the endpoint defaults
+    to 30 per page and a busy commit carries far more (one observed
+    commit reports 50), which on a partial read drops whichever runs fall
+    past the cut -- silently turning a ``fail`` into a ``pass`` when the
+    failing run is the one left off.
     """
     if _checks_disabled(credentials, base, owner, repo):
         return 'unknown'
+    runs: list[dict[str, typing.Any]] = []
+    params: dict[str, str] = {'per_page': '100'}
     try:
-        resp = await _request(
-            client, 'GET', f'/commits/{sha}/check-runs', max_wait=max_wait
-        )
-        if resp.status_code == 403:
-            _record_checks_disabled(credentials, base, owner, repo)
-            return 'unknown'
-        if resp.status_code != 200:
-            return 'unknown'
-        payload = typing.cast('dict[str, typing.Any]', resp.json())
+        for page in range(1, _MAX_CHECK_RUN_PAGES + 1):
+            resp = await _request(
+                client,
+                'GET',
+                f'/commits/{sha}/check-runs',
+                params=params,
+                max_wait=max_wait,
+            )
+            if resp.status_code == 403:
+                _record_checks_disabled(credentials, base, owner, repo)
+                return 'unknown'
+            if resp.status_code != 200:
+                return 'unknown'
+            payload = typing.cast('dict[str, typing.Any]', resp.json())
+            runs.extend(payload.get('check_runs') or [])
+            next_url = _next_page_url(resp.headers.get('link'))
+            next_page = (
+                _query_param(next_url, 'page')
+                if next_url is not None
+                else None
+            )
+            if next_page is None:
+                break
+            params['page'] = next_page
+            if page == _MAX_CHECK_RUN_PAGES:
+                LOGGER.warning(
+                    'github-commit-sync truncated check-runs for %s at %d '
+                    'pages (%d runs); ci_status may be incomplete',
+                    _short_sha(sha),
+                    _MAX_CHECK_RUN_PAGES,
+                    len(runs),
+                )
     except Exception:  # noqa: BLE001 - CI status is best-effort metadata
         return 'unknown'
-    return _check_runs_to_status(payload)
+    return _check_runs_to_status({'check_runs': runs})
 
 
 async def _hydrate_ci(
@@ -826,6 +894,11 @@ class SyncCommitsConfig(pydantic.BaseModel):
 
     Selectors resolve against the event context, so the push body lives
     under ``/payload`` (e.g. ``/payload/after``).
+
+    A rule bound to a non-push event points ``after_selector`` at that
+    body's head SHA and leaves ``before_selector`` alone: the default
+    ``/payload/before`` does not resolve there, which is what selects
+    :func:`sync_commits`' single-commit path.
     """
 
     before_selector: JsonPointer = pydantic.Field(
@@ -886,7 +959,21 @@ async def sync_commits(
     action_config: SyncCommitsConfig,
     event: object,
 ) -> None:
-    """Sync the commits in a ``push`` delivery into the ``commits`` table.
+    """Sync the commits a delivery attests to into the ``commits`` table.
+
+    The range synced is chosen from what ``before_selector`` resolves to,
+    which separates three cases that must not be collapsed:
+
+    * **a usable SHA** -- an ordinary push; sync ``before...after``.
+    * **nothing at all** (the pointer does not resolve) -- the delivery
+      has no notion of a previous head, so the only commit it attests to
+      is ``after``; sync that one commit.  This is the ``workflow_run``
+      shape, where falling through to the ``_last_known_sha`` compare
+      below yields an empty ``head...head`` range and silently syncs
+      nothing.
+    * **the zero SHA** -- a push that *does* carry a before, naming no
+      prior commit (a new branch).  Heal from the last commit stored for
+      the project, else fall back to a bounded recent-history walk.
 
     Branch gating is the rule's CEL ``filter_expression``'s job; this
     action does not filter refs itself.
@@ -911,6 +998,10 @@ async def sync_commits(
                 raw = await _fetch_compare_commits(
                     client, before, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
                 )
+            elif before is None:
+                raw = await _fetch_single_commit(
+                    client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                )
             else:
                 last = await _last_known_sha(ctx.project_id)
                 if last:

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/src/imbi/plugins/github/deployment.py

@@ -506,6 +506,44 @@ def _commit_from_payload(payload: dict[str, typing.Any]) -> Commit:
     )
 
 
+def _latest_runs(
+    raw_runs: list[dict[str, typing.Any]],
+) -> list[dict[str, typing.Any]]:
+    """Collapse ``check_runs`` to the current run for each check.
+
+    GitHub keeps every historical run for a commit in the
+    ``/commits/{sha}/check-runs`` payload, so a workflow that failed and
+    was re-run to green reports both.  Rolling up that flat set pins the
+    commit at ``fail`` forever -- no re-run can ever clear it.
+
+    ``filter=latest`` does not help: it de-duplicates re-run *attempts*
+    within a single check suite, and a re-run dispatched as a fresh
+    workflow run gets a suite (and a check run) of its own.  The
+    de-duplication has to happen here.
+
+    Runs are keyed on ``(app.id, name)`` rather than ``name`` alone so
+    two apps publishing a same-named check stay distinct, and ordered by
+    check-run ``id``, which is monotonic at creation.  Timestamps are not
+    usable as a sort key -- skipped runs report ``completed_at`` earlier
+    than ``started_at``.  A run carrying no integer ``id`` cannot be
+    ordered against anything, so it is passed through untouched rather
+    than being discarded on a guess.
+    """
+    latest: dict[tuple[str, str], tuple[int, dict[str, typing.Any]]] = {}
+    unordered: list[dict[str, typing.Any]] = []
+    for run in raw_runs:
+        run_id = run.get('id')
+        if isinstance(run_id, bool) or not isinstance(run_id, int):
+            unordered.append(run)
+            continue
+        app: dict[str, typing.Any] = run.get('app') or {}
+        key = (str(app.get('id') or ''), str(run.get('name') or ''))
+        current = latest.get(key)
+        if current is None or run_id > current[0]:
+            latest[key] = (run_id, run)
+    return [run for _, run in latest.values()] + unordered
+
+
 def _check_runs_to_status(
     payload: dict[str, typing.Any],
 ) -> typing.Literal['pass', 'fail', 'warn', 'unknown']:
@@ -513,12 +551,17 @@ def _check_runs_to_status(
     raw_runs: list[dict[str, typing.Any]] = payload.get('check_runs') or []
     if not raw_runs:
         return 'unknown'
+    runs = _latest_runs(raw_runs)
     # Don't roll up while any run is still in flight — a mix of one
     # ``success`` and one ``in_progress`` would otherwise surface as
-    # ``pass`` because the in-progress conclusion is ``None``.
-    if any(str(run.get('status') or '') != 'completed' for run in raw_runs):
+    # ``pass`` because the in-progress conclusion is ``None``.  Scan only
+    # the surviving runs: a *superseded* run left non-terminal (a suite
+    # GitHub cancelled mid-flight, which happens in the wild) would
+    # otherwise pin the commit at ``unknown`` just as permanently as the
+    # stale ``failure`` pinned it at ``fail``.
+    if any(str(run.get('status') or '') != 'completed' for run in runs):
         return 'unknown'
-    conclusions = {str(run.get('conclusion') or '') for run in raw_runs}
+    conclusions = {str(run.get('conclusion') or '') for run in runs}
     failed = {'failure', 'timed_out', 'action_required'}
     if conclusions & failed:
         return 'fail'

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/tests/test_commits.py

@@ -87,6 +87,27 @@ def _push(
     }
 
 
+def _workflow_run(
+    *,
+    head: str = 'b' * 40,
+    branch: str = 'main',
+    full_name: str = 'octo/demo',
+    repo_url: str = 'https://api.github.com/repos/octo/demo',
+) -> dict[str, object]:
+    """A ``workflow_run`` body: a head SHA, and no ``before`` anywhere."""
+    return {
+        'action': 'completed',
+        'workflow': {'name': 'CI/CD'},
+        'workflow_run': {
+            'head_sha': head,
+            'head_branch': branch,
+            'event': 'push',
+            'conclusion': 'success',
+        },
+        'repository': {'full_name': full_name, 'url': repo_url},
+    }
+
+
 def _event(body: dict[str, typing.Any]) -> dict[str, typing.Any]:
     """Wrap a push body in the event context handlers now receive."""
     return {
@@ -132,6 +153,10 @@ def _check_runs_url(sha: str) -> str:
     return f'https://api.github.com/repos/octo/demo/commits/{sha}/check-runs'
 
 
+# Any commit's ``/check-runs``, with or without the paging query string.
+_CHECK_RUNS_RE = r'.+/commits/.+/check-runs(\?.*)?$'
+
+
 class ConfigTestCase(unittest.TestCase):
     def test_sync_commits_defaults(self) -> None:
         cfg = commits.SyncCommitsConfig()
@@ -223,7 +248,20 @@ class ApiBaseResolutionTestCase(unittest.TestCase):
         self.assertIsNone(self._base(ctx=_ctx(), repo_url='not-a-repo-url'))
 
 
+_WORKFLOW_RUN_CONFIG = commits.SyncCommitsConfig(
+    after_selector='/payload/workflow_run/head_sha',
+    ref_selector='/payload/workflow_run/head_branch',
+)
+
+
 class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        # Same process-wide /check-runs 403 cache SyncCommitsCiStatus
+        # clears: without this a 403 recorded by another test suppresses
+        # hydration here and the ci_status assertions below read
+        # 'unknown' depending on execution order.
+        deployment._CHECKS_DISABLED_TOKENS.clear()
+
     @respx.mock
     async def test_normal_compare_inserts_records(self) -> None:
         base, head = 'a' * 40, 'b' * 40
@@ -326,6 +364,119 @@ class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertTrue(route.called)
         insert.assert_awaited_once()
 
+    @respx.mock
+    async def test_absent_before_syncs_the_single_head_commit(self) -> None:
+        head = 'b' * 40
+        route = respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        respx.get(_check_runs_url(head)).mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        self.assertTrue(route.called)
+        insert.assert_awaited_once()
+        table, records = _await_args(insert)
+        self.assertEqual('commits', table)
+        self.assertEqual(1, len(records))
+        self.assertEqual(head, records[0].sha)
+        self.assertEqual('main', records[0].ref)
+        self.assertEqual('pass', records[0].ci_status)
+
+    @respx.mock
+    async def test_absent_before_never_consults_last_known_sha(self) -> None:
+        """The single-commit path must not fall through to a compare.
+
+        Regression guard: resolving ``_last_known_sha`` yields the head
+        itself once a prior delivery stored it, and ``head...head`` is an
+        empty range -- the commit is then silently never refreshed.
+        """
+        head = 'b' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        respx.get(_check_runs_url(head)).mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        with (
+            mock.patch(_QUERY, new=mock.AsyncMock()) as query,
+            mock.patch(_INSERT, new=mock.AsyncMock()) as insert,
+        ):
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        query.assert_not_awaited()
+        insert.assert_awaited_once()
+
+    @respx.mock
+    async def test_ci_status_pages_past_the_first_check_runs_page(
+        self,
+    ) -> None:
+        """A failure past page 1 must still roll the commit up to ``fail``.
+
+        The endpoint defaults to 30 runs per page; reading only the first
+        page turns a failing commit into a passing one whenever the
+        failing run sorts past the cut.
+        """
+        head = 'b' * 40
+        url = _check_runs_url(head)
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        route = respx.get(url).mock(
+            side_effect=[
+                httpx.Response(
+                    200,
+                    json=_check_runs('success'),
+                    headers={'link': f'<{url}?page=2>; rel="next"'},
+                ),
+                httpx.Response(200, json=_check_runs('failure')),
+            ]
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        self.assertEqual(2, route.call_count)
+        self.assertEqual(
+            '100', route.calls[0].request.url.params.get('per_page')
+        )
+        insert.assert_awaited_once()
+        _, records = _await_args(insert)
+        self.assertEqual('fail', records[0].ci_status)
+
+    @respx.mock
+    async def test_absent_before_unknown_commit_inserts_nothing(self) -> None:
+        head = 'b' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(404, json={}))
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(commits.LOGGER, level='WARNING'):
+                await commits.sync_commits(
+                    ctx=_ctx(),
+                    credentials=_CREDS,
+                    external_identifier='',
+                    action_config=_WORKFLOW_RUN_CONFIG,
+                    event=_event(_workflow_run(head=head)),
+                )
+        insert.assert_not_awaited()
+
     @respx.mock
     async def test_compare_pagination_collects_all_pages(self) -> None:
         base, head = 'a' * 40, 'b' * 40
@@ -448,10 +599,43 @@ class SyncCommitsCiStatusTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual('pass', records[0].ci_status)
         self.assertEqual('fail', records[1].ci_status)
 
+    @respx.mock
+    async def test_rerun_to_green_syncs_as_pass(self) -> None:
+        # The sync path shares the deployment plugin's rollup, so it
+        # inherits the re-run de-duplication -- without it the API and
+        # the ClickHouse table agree with each other while both report a
+        # green commit as 'fail' (issue #282).
+        self._mock_compare('c' * 40)
+        respx.get(_check_runs_url('c' * 40)).mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    'check_runs': [
+                        {
+                            'id': 1,
+                            'name': 'acceptance',
+                            'status': 'completed',
+                            'conclusion': 'failure',
+                            'app': {'id': 7},
+                        },
+                        {
+                            'id': 2,
+                            'name': 'acceptance',
+                            'status': 'completed',
+                            'conclusion': 'success',
+                            'app': {'id': 7},
+                        },
+                    ]
+                },
+            )
+        )
+        records = await self._run()
+        self.assertEqual('pass', records[0].ci_status)
+
     @respx.mock
     async def test_403_degrades_and_caches(self) -> None:
         self._mock_compare('c' * 40, 'd' * 40)
-        route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+        route = respx.get(url__regex=_CHECK_RUNS_RE).mock(
             return_value=httpx.Response(403)
         )
         records = await self._run()
@@ -1274,7 +1458,7 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(f'{self._REPO}/git/matching-refs/tags').mock(
             return_value=httpx.Response(200, json=[])
         )
-        ci_route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+        ci_route = respx.get(url__regex=_CHECK_RUNS_RE).mock(
             return_value=httpx.Response(200, json=_check_runs('success'))
         )
         with mock.patch.object(commits, '_BACKFILL_CI_LIMIT', 1):
@@ -1861,7 +2045,9 @@ class SyncNewCommitsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(1, written)
         params = history.calls.last.request.url.params
         self.assertNotIn('since', params)
-        self.assertEqual(str(commits._BACKFILL_CI_LIMIT), params['per_page'])
+        self.assertEqual(
+            str(commits._RECENT_FALLBACK_COMMITS), params['per_page']
+        )
 
     @respx.mock
     async def test_uncomparable_stored_sha_falls_back(self) -> None:

{imbi_plugin_github-2.29.3 → imbi_plugin_github-2.30.0}/tests/test_deployment.py

@@ -19,6 +19,7 @@ from imbi.plugins.github.deployment import (
     GitHubDeployment,
     _active_scan_limit,
     _artifact_status,
+    _check_runs_to_status,
     _mainline_branches,
     _repo_root_from_redirect,
 )
@@ -565,10 +566,17 @@ class CommitsTestCase(unittest.IsolatedAsyncioTestCase):
                 json={
                     'check_runs': [
                         {
+                            'id': 1,
+                            'name': 'unit',
                             'status': 'completed',
                             'conclusion': 'success',
                         },
-                        {'status': 'in_progress', 'conclusion': None},
+                        {
+                            'id': 2,
+                            'name': 'acceptance',
+                            'status': 'in_progress',
+                            'conclusion': None,
+                        },
                     ]
                 },
             )
@@ -2569,6 +2577,144 @@ class CheckStatusTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(status, 'unknown')
 
 
+def _run(
+    run_id: int,
+    conclusion: str | None,
+    *,
+    name: str = 'run / Run acceptance tests (testing)',
+    status: str = 'completed',
+    app_id: int = 15368,
+) -> dict[str, object]:
+    """One entry of a ``/check-runs`` payload."""
+    return {
+        'id': run_id,
+        'name': name,
+        'status': status,
+        'conclusion': conclusion,
+        'app': {'id': app_id},
+    }
+
+
+class CheckRunsRollupTestCase(unittest.TestCase):
+    """``_check_runs_to_status`` must judge a commit on its *current* runs.
+
+    GitHub returns every historical run for a commit, so a check that
+    failed and was re-run to green appears twice.  Rolling up the flat
+    set pinned such a commit at ``fail`` permanently -- see issue #282.
+    """
+
+    def test_superseded_failure_does_not_pin_fail(self) -> None:
+        # The reported case: two failures and a later success, all
+        # carrying the same check name.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'failure'),
+                    _run(2, 'failure'),
+                    _run(3, 'success'),
+                    _run(4, 'success', name='unit tests'),
+                    _run(5, 'skipped', name='deploy'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_latest_failure_still_fails(self) -> None:
+        # Don't over-correct: a check that went green and then red is
+        # red.  Payload order is deliberately not id order.
+        status = _check_runs_to_status(
+            {'check_runs': [_run(9, 'failure'), _run(3, 'success')]}
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_same_name_from_two_apps_is_not_collapsed(self) -> None:
+        # Two apps publishing a same-named check are distinct checks;
+        # collapsing them would hide the failing one.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'failure', app_id=111),
+                    _run(2, 'success', app_id=222),
+                ]
+            }
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_superseded_cancelled_does_not_warn(self) -> None:
+        # Cancel a hung job, re-run it green: the commit is green.
+        status = _check_runs_to_status(
+            {'check_runs': [_run(1, 'cancelled'), _run(2, 'success')]}
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_latest_cancelled_still_warns(self) -> None:
+        status = _check_runs_to_status(
+            {'check_runs': [_run(1, 'success'), _run(2, 'cancelled')]}
+        )
+        self.assertEqual(status, 'warn')
+
+    def test_superseded_in_flight_run_is_not_unknown(self) -> None:
+        # A suite GitHub cancelled mid-flight can be left non-terminal
+        # forever.  Only the current run's status gates the rollup --
+        # otherwise this trades a stuck ``fail`` for a stuck ``unknown``.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, None, status='queued'),
+                    _run(2, 'success'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'pass')
+
+    def test_current_run_in_flight_is_unknown(self) -> None:
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    _run(1, 'success'),
+                    _run(2, None, status='in_progress'),
+                ]
+            }
+        )
+        self.assertEqual(status, 'unknown')
+
+    def test_ordering_ignores_timestamps(self) -> None:
+        # ``skipped`` runs report ``completed_at`` before ``started_at``,
+        # so only the monotonic ``id`` is a safe sort key.
+        older = _run(1, 'failure')
+        older.update(
+            {
+                'started_at': '2026-08-20T19:56:25Z',
+                'completed_at': '2026-08-20T19:58:00Z',
+            }
+        )
+        newer = _run(2, 'success')
+        newer.update(
+            {
+                'started_at': '2026-08-20T16:40:02Z',
+                'completed_at': '2026-08-20T16:38:51Z',
+            }
+        )
+        self.assertEqual(
+            _check_runs_to_status({'check_runs': [older, newer]}), 'pass'
+        )
+
+    def test_runs_without_ids_are_not_collapsed(self) -> None:
+        # Nothing orders these, so neither may be dropped on a guess.
+        status = _check_runs_to_status(
+            {
+                'check_runs': [
+                    {'status': 'completed', 'conclusion': 'success'},
+                    {'status': 'completed', 'conclusion': 'failure'},
+                ]
+            }
+        )
+        self.assertEqual(status, 'fail')
+
+    def test_empty_payload_is_unknown(self) -> None:
+        self.assertEqual(_check_runs_to_status({'check_runs': []}), 'unknown')
+
+
 class TagAndReleaseTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock
     async def test_create_tag_and_ref(self) -> None: