imbi-plugin-github 2.37.0__tar.gz → 2.38.0__tar.gz

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.37.0
+Version: 2.38.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.37.0
+Requires-Dist: imbi-common[databases]==2.38.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.37.0"
+version = "2.38.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.37.0",
+  "imbi-common[databases]==2.38.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/src/imbi/plugins/github/_app_auth.py

@@ -255,7 +255,11 @@ async def _discover_installation_id(
 
 
 async def _mint(
-    client: httpx.AsyncClient, installation_id: str, scope: FrozenScope
+    client: httpx.AsyncClient,
+    installation_id: str,
+    scope: FrozenScope,
+    repositories: collections.abc.Sequence[str] | None = None,
+    repository_ids: collections.abc.Sequence[int] | None = None,
 ) -> tuple[str, object]:
     """Exchange the App JWT for an installation access token.
 
@@ -265,6 +269,11 @@ async def _mint(
     installation does not hold is a ``422``, which is the right failure:
     a capability asking for authority the App was never given should say
     so rather than act with less.
+
+    ``repositories`` (names without the owner) limits the token to those
+    repositories of the installation. ``repository_ids`` does the same
+    with the numeric repository ids; GitHub refuses an id that is not in
+    the installation (``422``).
     """
     # ``is not None`` rather than truthiness: ``freeze_scope({})`` is an
     # empty tuple, and asking GitHub for *no* permissions must send
@@ -274,6 +283,10 @@ async def _mint(
     body: dict[str, typing.Any] | None = (
         {'permissions': dict(scope)} if scope is not None else None
     )
+    if repositories is not None:
+        body = {**(body or {}), 'repositories': list(repositories)}
+    if repository_ids is not None:
+        body = {**(body or {}), 'repository_ids': list(repository_ids)}
     resp = await client.post(
         f'/app/installations/{installation_id}/access_tokens', json=body
     )

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/src/imbi/plugins/github/deployment.py

@@ -1171,6 +1171,27 @@ class GitHubDeployment(DeploymentCapability):
                 return None
             return await self._blob_text(client, blob_sha)
 
+    async def get_file(
+        self,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+        path: str,
+        ref: str,
+    ) -> str | None:
+        """Read ``path`` at ``ref`` through the contents API, raw."""
+        async with self._client(
+            ctx, credentials, SCOPE_CONTENTS_READ
+        ) as client:
+            response = await client.get(
+                f'/contents/{urllib.parse.quote(path)}',
+                params={'ref': ref},
+                headers={'Accept': 'application/vnd.github.raw+json'},
+            )
+            if response.status_code == 404:
+                return None
+            response.raise_for_status()
+            return response.text
+
     async def list_commit_notes(
         self,
         ctx: PluginContext,

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/src/imbi/plugins/github/doctor.py

@@ -411,6 +411,7 @@ class GitHubDoctor(AnalysisCapability):
                     f'the GitHub API id {api_id!r}.',
                 )
             )
+            results.append(_verified_item(connection, api_id))
         else:
             results.append(
                 _item(
@@ -681,6 +682,7 @@ class GitHubDoctor(AnalysisCapability):
         if connection is not None:
             already_correct = (
                 connection.identifier == str(api_id)
+                and connection.verified_identifier == str(api_id)
                 and connection.canonical_url == desired_canonical
                 and ctx.project_links.get(slug) == html_url
             )
@@ -704,6 +706,36 @@ class GitHubDoctor(AnalysisCapability):
         )
 
 
+def _verified_item(
+    connection: ServiceConnection, api_id: str
+) -> AnalysisResultItem:
+    """Check that this plugin wrote the identifier from GitHub.
+
+    The ``github_app`` secret provider issues tokens only for a verified
+    identifier. An edge that a user created or edited by hand is not
+    verified until the repair writes it again from GitHub.
+    """
+    if connection.verified_identifier == api_id:
+        return _item(
+            'identifier-verified',
+            'Identifier verified',
+            'pass',
+            f'GitHub verified the EXISTS_IN identifier {api_id!r}.',
+        )
+    return _item(
+        'identifier-verified',
+        'Identifier verified',
+        'warn',
+        f'GitHub has not verified the EXISTS_IN identifier {api_id!r}. '
+        'GitHub App tokens are not issued for this project until you use '
+        'the Fix action.',
+        RemediationOffer(
+            id=_REPAIR_EDGE,
+            label='Verify the EXISTS_IN edge from GitHub',
+        ),
+    )
+
+
 def _body_unavailable_items() -> list[AnalysisResultItem]:
     """Return warn items for body-dependent checks when the fetch fails."""
     return [

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/tests/test_app_auth_scopes.py

@@ -140,6 +140,18 @@ class ScopedMintTestCase(unittest.IsolatedAsyncioTestCase):
             httpx.Response(200, content=route.calls[0].request.content).json(),
         )
 
+    @respx.mock
+    async def test_repositories_reach_the_mint_body(self) -> None:
+        route = _mock_token()
+        async with httpx.AsyncClient(base_url=_BASE) as client:
+            await _app_auth._mint(  # pyright: ignore[reportPrivateUsage]
+                client, '42', _app_auth.freeze_scope({}), ['demo']
+            )
+        self.assertEqual(
+            {'permissions': {}, 'repositories': ['demo']},
+            httpx.Response(200, content=route.calls[0].request.content).json(),
+        )
+
     @respx.mock
     async def test_same_scope_is_served_from_cache(self) -> None:
         route = _mock_token()

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/tests/test_deployment.py

@@ -3597,6 +3597,30 @@ class GitNotesTestCase(unittest.IsolatedAsyncioTestCase):
         )
         self.assertIsNone(note)
 
+    @respx.mock
+    async def test_get_file_reads_raw_content_at_ref(self) -> None:
+        route = respx.get(
+            f'{self.REPO}/contents/.claude-plugin/marketplace.json'
+        ).mock(return_value=httpx.Response(200, text='{"name": "x"}'))
+        text = await self.handler.get_file(
+            _ctx(), _CREDS, '.claude-plugin/marketplace.json', self.FULL_SHA
+        )
+        self.assertEqual('{"name": "x"}', text)
+        request = route.calls.last.request
+        self.assertEqual(self.FULL_SHA, request.url.params['ref'])
+        self.assertEqual(
+            'application/vnd.github.raw+json', request.headers['Accept']
+        )
+
+    @respx.mock
+    async def test_get_file_missing_is_none(self) -> None:
+        respx.get(f'{self.REPO}/contents/missing.json').mock(
+            return_value=httpx.Response(404, json={'message': 'Not Found'})
+        )
+        self.assertIsNone(
+            await self.handler.get_file(_ctx(), _CREDS, 'missing.json', 'x')
+        )
+
     @respx.mock
     async def test_get_commit_note_no_entry_is_none(self) -> None:
         self._mock_tree([{'type': 'blob', 'path': 'e' * 40, 'sha': 'b1'}])

{imbi_plugin_github-2.37.0 → imbi_plugin_github-2.38.0}/tests/test_doctor.py

@@ -60,6 +60,7 @@ def _ctx(
                 integration_slug=_TPS_SLUG,
                 identifier='134741',
                 canonical_url=_CANONICAL,
+                verified_identifier='134741',
             )
         ]
     default_links: dict[str, str] = {
@@ -142,8 +143,9 @@ class AnalyzeTestCase(unittest.IsolatedAsyncioTestCase):
         plugin = GitHubDoctor()
         results = await plugin.analyze(_ctx(), _CREDS)
         by = _by_slug(results)
-        self.assertEqual(len(results), 7)
+        self.assertEqual(len(results), 8)
         self.assertEqual(by['exists-in'].status, 'pass')
+        self.assertEqual(by['identifier-verified'].status, 'pass')
         self.assertEqual(by['canonical-url'].status, 'pass')
         self.assertEqual(by['identifier-type'].status, 'pass')
         self.assertEqual(by['identifier-match'].status, 'pass')
@@ -448,6 +450,24 @@ class RemediationOfferTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertIsNotNone(offer)
         self.assertEqual(offer.id, _REPAIR_EDGE)
 
+    @respx.mock
+    async def test_unverified_identifier_offers_the_repair(self) -> None:
+        respx.get(_CANONICAL).mock(
+            return_value=httpx.Response(200, json=_REPO_PAYLOAD)
+        )
+        connection = ServiceConnection(
+            integration_slug=_TPS_SLUG,
+            identifier='134741',
+            canonical_url=_CANONICAL,
+        )
+        results = await GitHubDoctor().analyze(
+            _ctx(connections=[connection]), _CREDS
+        )
+        item = _by_slug(results)['identifier-verified']
+        self.assertEqual(item.status, 'warn')
+        assert item.remediation is not None
+        self.assertEqual(item.remediation.id, _REPAIR_EDGE)
+
     @respx.mock
     async def test_passing_findings_have_no_offer(self) -> None:
         respx.get(_CANONICAL).mock(
@@ -546,6 +566,25 @@ class RemediateTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(result.status, 'noop')
         self.assertIsNone(ctx.service_writeback)
 
+    @respx.mock
+    async def test_edge_repair_verifies_an_unverified_edge(self) -> None:
+        respx.get(_CANONICAL).mock(
+            return_value=httpx.Response(200, json=_REPO_PAYLOAD)
+        )
+        ctx = _ctx(
+            connections=[
+                ServiceConnection(
+                    integration_slug=_TPS_SLUG,
+                    identifier='134741',
+                    canonical_url=_CANONICAL,
+                )
+            ]
+        )
+        result = await GitHubDoctor().remediate(ctx, _CREDS, _REPAIR_EDGE)
+        self.assertEqual(result.status, 'fixed')
+        assert ctx.service_writeback is not None
+        self.assertEqual(ctx.service_writeback.identifier, '134741')
+
     @respx.mock
     async def test_github_link_repair_emits_link_writeback(self) -> None:
         respx.get(_CANONICAL).mock(