imbi-plugin-github 2.29.4__tar.gz → 2.30.0__tar.gz

{imbi_plugin_github-2.29.4 → imbi_plugin_github-2.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.29.4
+Version: 2.30.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.29.4
+Requires-Dist: imbi-common[databases]==2.30.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.29.4 → imbi_plugin_github-2.30.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.29.4"
+version = "2.30.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.29.4",
+  "imbi-common[databases]==2.30.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.29.4 → imbi_plugin_github-2.30.0}/src/imbi/plugins/github/commits.py

@@ -85,11 +85,24 @@ _MAX_HISTORY_PAGES = 100
 # ``_MAX_HISTORY_PAGES``: this path exists to pick up the handful of
 # commits a release build pushed, not to stand in for a full backfill.
 _MAX_SINCE_PAGES = 10
-# CI status is hydrated with one ``/check-runs`` call per commit, which is
-# prohibitively expensive across a full-history backfill.  Bound it to the
-# most-recent commits (the only ones whose CI is still meaningful and
-# unexpired); older commits keep the ``'unknown'`` default.
-_BACKFILL_CI_LIMIT = 25
+# CI status is hydrated with one ``/check-runs`` call per commit (more
+# when it pages), which is prohibitively expensive across a full-history
+# backfill.  Bound it to the most-recent commits; older commits keep the
+# ``'unknown'`` default.
+#
+# 200 is where the gap actually closes -- the ``recent-commits`` endpoint
+# caps ``limit`` at 200 and the deployments tab asks for exactly that
+# (``COMMIT_WINDOW``), so hydrating past 200 cannot change what a reader
+# sees.  This deliberately stops at half of it: backfills are already
+# slow, and every commit here costs at least one ``/check-runs`` call, so
+# 25 -> 200 would have octupled the request count in one step.  100 buys
+# most of the visible window at 4x rather than 8x; rows 100-199 keep the
+# ``'unknown'`` default until this is raised or made configurable.
+_BACKFILL_CI_LIMIT = 100
+# Pages of ``/check-runs`` to walk per commit before giving up.  100 per
+# page * 5 = 500 runs, well past the busiest observed commit (50), so the
+# cap only bounds a pathological repo rather than shaping normal reads.
+_MAX_CHECK_RUN_PAGES = 5
 # Page size for ``sync_new_commits``' last-resort walk, used when nothing
 # is stored *and* no ``since`` was supplied. Sized to cover a release
 # build's handful of pushed commits, not to approximate a backfill.
@@ -577,6 +590,29 @@ async def _fetch_recent_commits(
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
 
 
+async def _fetch_single_commit(
+    client: httpx.AsyncClient, sha: str, *, max_wait: float
+) -> list[dict[str, typing.Any]]:
+    """``GET /commits/{sha}`` as a one-item list, ``[]`` when absent.
+
+    For a delivery that names a head commit but carries no previous
+    head -- a ``workflow_run`` / ``check_suite`` style event rather than
+    a ``push`` -- the only commit the payload attests to is *sha*
+    itself.  The response shape matches a ``commits[]`` entry from the
+    compare API, so :func:`_commit_record` maps it unchanged and the
+    caller's CI hydration and author resolution work on the list as-is.
+    """
+    resp = await _request(client, 'GET', f'/commits/{sha}', max_wait=max_wait)
+    if resp.status_code == 404:
+        LOGGER.warning(
+            'github-commit-sync: commit %s not found; nothing to sync',
+            _short_sha(sha),
+        )
+        return []
+    resp.raise_for_status()
+    return [typing.cast('dict[str, typing.Any]', resp.json())]
+
+
 async def _ci_status(
     client: httpx.AsyncClient,
     sha: str,
@@ -595,22 +631,54 @@ async def _ci_status(
     non-200, a parse error, a network error, or a rate-limit pause -- CI
     status is best-effort metadata and must never fail the sync, mirroring
     the swallow-and-continue contract the rest of this module follows.
+
+    The whole run set has to be in hand before rolling up, so this pages
+    to the end rather than reading the first page: the endpoint defaults
+    to 30 per page and a busy commit carries far more (one observed
+    commit reports 50), which on a partial read drops whichever runs fall
+    past the cut -- silently turning a ``fail`` into a ``pass`` when the
+    failing run is the one left off.
     """
     if _checks_disabled(credentials, base, owner, repo):
         return 'unknown'
+    runs: list[dict[str, typing.Any]] = []
+    params: dict[str, str] = {'per_page': '100'}
     try:
-        resp = await _request(
-            client, 'GET', f'/commits/{sha}/check-runs', max_wait=max_wait
-        )
-        if resp.status_code == 403:
-            _record_checks_disabled(credentials, base, owner, repo)
-            return 'unknown'
-        if resp.status_code != 200:
-            return 'unknown'
-        payload = typing.cast('dict[str, typing.Any]', resp.json())
+        for page in range(1, _MAX_CHECK_RUN_PAGES + 1):
+            resp = await _request(
+                client,
+                'GET',
+                f'/commits/{sha}/check-runs',
+                params=params,
+                max_wait=max_wait,
+            )
+            if resp.status_code == 403:
+                _record_checks_disabled(credentials, base, owner, repo)
+                return 'unknown'
+            if resp.status_code != 200:
+                return 'unknown'
+            payload = typing.cast('dict[str, typing.Any]', resp.json())
+            runs.extend(payload.get('check_runs') or [])
+            next_url = _next_page_url(resp.headers.get('link'))
+            next_page = (
+                _query_param(next_url, 'page')
+                if next_url is not None
+                else None
+            )
+            if next_page is None:
+                break
+            params['page'] = next_page
+            if page == _MAX_CHECK_RUN_PAGES:
+                LOGGER.warning(
+                    'github-commit-sync truncated check-runs for %s at %d '
+                    'pages (%d runs); ci_status may be incomplete',
+                    _short_sha(sha),
+                    _MAX_CHECK_RUN_PAGES,
+                    len(runs),
+                )
     except Exception:  # noqa: BLE001 - CI status is best-effort metadata
         return 'unknown'
-    return _check_runs_to_status(payload)
+    return _check_runs_to_status({'check_runs': runs})
 
 
 async def _hydrate_ci(
@@ -826,6 +894,11 @@ class SyncCommitsConfig(pydantic.BaseModel):
 
     Selectors resolve against the event context, so the push body lives
     under ``/payload`` (e.g. ``/payload/after``).
+
+    A rule bound to a non-push event points ``after_selector`` at that
+    body's head SHA and leaves ``before_selector`` alone: the default
+    ``/payload/before`` does not resolve there, which is what selects
+    :func:`sync_commits`' single-commit path.
     """
 
     before_selector: JsonPointer = pydantic.Field(
@@ -886,7 +959,21 @@ async def sync_commits(
     action_config: SyncCommitsConfig,
     event: object,
 ) -> None:
-    """Sync the commits in a ``push`` delivery into the ``commits`` table.
+    """Sync the commits a delivery attests to into the ``commits`` table.
+
+    The range synced is chosen from what ``before_selector`` resolves to,
+    which separates three cases that must not be collapsed:
+
+    * **a usable SHA** -- an ordinary push; sync ``before...after``.
+    * **nothing at all** (the pointer does not resolve) -- the delivery
+      has no notion of a previous head, so the only commit it attests to
+      is ``after``; sync that one commit.  This is the ``workflow_run``
+      shape, where falling through to the ``_last_known_sha`` compare
+      below yields an empty ``head...head`` range and silently syncs
+      nothing.
+    * **the zero SHA** -- a push that *does* carry a before, naming no
+      prior commit (a new branch).  Heal from the last commit stored for
+      the project, else fall back to a bounded recent-history walk.
 
     Branch gating is the rule's CEL ``filter_expression``'s job; this
     action does not filter refs itself.
@@ -911,6 +998,10 @@ async def sync_commits(
                 raw = await _fetch_compare_commits(
                     client, before, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
                 )
+            elif before is None:
+                raw = await _fetch_single_commit(
+                    client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                )
             else:
                 last = await _last_known_sha(ctx.project_id)
                 if last:

{imbi_plugin_github-2.29.4 → imbi_plugin_github-2.30.0}/tests/test_commits.py

@@ -87,6 +87,27 @@ def _push(
     }
 
 
+def _workflow_run(
+    *,
+    head: str = 'b' * 40,
+    branch: str = 'main',
+    full_name: str = 'octo/demo',
+    repo_url: str = 'https://api.github.com/repos/octo/demo',
+) -> dict[str, object]:
+    """A ``workflow_run`` body: a head SHA, and no ``before`` anywhere."""
+    return {
+        'action': 'completed',
+        'workflow': {'name': 'CI/CD'},
+        'workflow_run': {
+            'head_sha': head,
+            'head_branch': branch,
+            'event': 'push',
+            'conclusion': 'success',
+        },
+        'repository': {'full_name': full_name, 'url': repo_url},
+    }
+
+
 def _event(body: dict[str, typing.Any]) -> dict[str, typing.Any]:
     """Wrap a push body in the event context handlers now receive."""
     return {
@@ -132,6 +153,10 @@ def _check_runs_url(sha: str) -> str:
     return f'https://api.github.com/repos/octo/demo/commits/{sha}/check-runs'
 
 
+# Any commit's ``/check-runs``, with or without the paging query string.
+_CHECK_RUNS_RE = r'.+/commits/.+/check-runs(\?.*)?$'
+
+
 class ConfigTestCase(unittest.TestCase):
     def test_sync_commits_defaults(self) -> None:
         cfg = commits.SyncCommitsConfig()
@@ -223,7 +248,20 @@ class ApiBaseResolutionTestCase(unittest.TestCase):
         self.assertIsNone(self._base(ctx=_ctx(), repo_url='not-a-repo-url'))
 
 
+_WORKFLOW_RUN_CONFIG = commits.SyncCommitsConfig(
+    after_selector='/payload/workflow_run/head_sha',
+    ref_selector='/payload/workflow_run/head_branch',
+)
+
+
 class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        # Same process-wide /check-runs 403 cache SyncCommitsCiStatus
+        # clears: without this a 403 recorded by another test suppresses
+        # hydration here and the ci_status assertions below read
+        # 'unknown' depending on execution order.
+        deployment._CHECKS_DISABLED_TOKENS.clear()
+
     @respx.mock
     async def test_normal_compare_inserts_records(self) -> None:
         base, head = 'a' * 40, 'b' * 40
@@ -326,6 +364,119 @@ class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertTrue(route.called)
         insert.assert_awaited_once()
 
+    @respx.mock
+    async def test_absent_before_syncs_the_single_head_commit(self) -> None:
+        head = 'b' * 40
+        route = respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        respx.get(_check_runs_url(head)).mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        self.assertTrue(route.called)
+        insert.assert_awaited_once()
+        table, records = _await_args(insert)
+        self.assertEqual('commits', table)
+        self.assertEqual(1, len(records))
+        self.assertEqual(head, records[0].sha)
+        self.assertEqual('main', records[0].ref)
+        self.assertEqual('pass', records[0].ci_status)
+
+    @respx.mock
+    async def test_absent_before_never_consults_last_known_sha(self) -> None:
+        """The single-commit path must not fall through to a compare.
+
+        Regression guard: resolving ``_last_known_sha`` yields the head
+        itself once a prior delivery stored it, and ``head...head`` is an
+        empty range -- the commit is then silently never refreshed.
+        """
+        head = 'b' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        respx.get(_check_runs_url(head)).mock(
+            return_value=httpx.Response(200, json=_check_runs('success'))
+        )
+        with (
+            mock.patch(_QUERY, new=mock.AsyncMock()) as query,
+            mock.patch(_INSERT, new=mock.AsyncMock()) as insert,
+        ):
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        query.assert_not_awaited()
+        insert.assert_awaited_once()
+
+    @respx.mock
+    async def test_ci_status_pages_past_the_first_check_runs_page(
+        self,
+    ) -> None:
+        """A failure past page 1 must still roll the commit up to ``fail``.
+
+        The endpoint defaults to 30 runs per page; reading only the first
+        page turns a failing commit into a passing one whenever the
+        failing run sorts past the cut.
+        """
+        head = 'b' * 40
+        url = _check_runs_url(head)
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(200, json=_commit(head)))
+        route = respx.get(url).mock(
+            side_effect=[
+                httpx.Response(
+                    200,
+                    json=_check_runs('success'),
+                    headers={'link': f'<{url}?page=2>; rel="next"'},
+                ),
+                httpx.Response(200, json=_check_runs('failure')),
+            ]
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=_CREDS,
+                external_identifier='',
+                action_config=_WORKFLOW_RUN_CONFIG,
+                event=_event(_workflow_run(head=head)),
+            )
+        self.assertEqual(2, route.call_count)
+        self.assertEqual(
+            '100', route.calls[0].request.url.params.get('per_page')
+        )
+        insert.assert_awaited_once()
+        _, records = _await_args(insert)
+        self.assertEqual('fail', records[0].ci_status)
+
+    @respx.mock
+    async def test_absent_before_unknown_commit_inserts_nothing(self) -> None:
+        head = 'b' * 40
+        respx.get(
+            f'https://api.github.com/repos/octo/demo/commits/{head}'
+        ).mock(return_value=httpx.Response(404, json={}))
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            with self.assertLogs(commits.LOGGER, level='WARNING'):
+                await commits.sync_commits(
+                    ctx=_ctx(),
+                    credentials=_CREDS,
+                    external_identifier='',
+                    action_config=_WORKFLOW_RUN_CONFIG,
+                    event=_event(_workflow_run(head=head)),
+                )
+        insert.assert_not_awaited()
+
     @respx.mock
     async def test_compare_pagination_collects_all_pages(self) -> None:
         base, head = 'a' * 40, 'b' * 40
@@ -484,7 +635,7 @@ class SyncCommitsCiStatusTestCase(unittest.IsolatedAsyncioTestCase):
     @respx.mock
     async def test_403_degrades_and_caches(self) -> None:
         self._mock_compare('c' * 40, 'd' * 40)
-        route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+        route = respx.get(url__regex=_CHECK_RUNS_RE).mock(
             return_value=httpx.Response(403)
         )
         records = await self._run()
@@ -1307,7 +1458,7 @@ class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
         respx.get(f'{self._REPO}/git/matching-refs/tags').mock(
             return_value=httpx.Response(200, json=[])
         )
-        ci_route = respx.get(url__regex=r'.+/commits/.+/check-runs$').mock(
+        ci_route = respx.get(url__regex=_CHECK_RUNS_RE).mock(
             return_value=httpx.Response(200, json=_check_runs('success'))
         )
         with mock.patch.object(commits, '_BACKFILL_CI_LIMIT', 1):
@@ -1894,7 +2045,9 @@ class SyncNewCommitsTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(1, written)
         params = history.calls.last.request.url.params
         self.assertNotIn('since', params)
-        self.assertEqual(str(commits._BACKFILL_CI_LIMIT), params['per_page'])
+        self.assertEqual(
+            str(commits._RECENT_FALLBACK_COMMITS), params['per_page']
+        )
 
     @respx.mock
     async def test_uncomparable_stored_sha_falls_back(self) -> None: