imbi-plugin-github 2.41.0__py3-none-any.whl → 2.43.0__py3-none-any.whl

imbi/plugins/github/deployment.py

@@ -65,6 +65,7 @@ from imbi.common.plugins.base import (
     WorkflowFile,
 )
 from imbi.common.plugins.errors import PluginAuthenticationFailed
+from imbi.plugins.github import public
 from imbi.plugins.github._hosts import flavor_host, host_to_api_base
 from imbi.plugins.github._repos import (
     derive_owner_repo_from_links,
@@ -654,6 +655,10 @@ class GitHubDeployment(DeploymentCapability):
     per call.
     """
 
+    @classmethod
+    def public_reader(cls, url: str) -> public.PublicRepository | None:
+        return public.PublicRepository.for_url(url)
+
     def _resolve_host(self, ctx: PluginContext) -> str:
         return flavor_host(ctx.integration_options, 'github deployment')
 

imbi/plugins/github/plugin.py

@@ -25,6 +25,7 @@ from imbi.common.plugins.base import (
     PluginManifest,
     PluginOption,
     WebhookActionsCapability,
+    WebhookSignature,
 )
 from imbi.plugins.github.commits import (
     GitHubCommitSync,
@@ -39,6 +40,7 @@ from imbi.plugins.github.pull_requests import (
     GitHubPullRequestSync,
     sync_pull_requests_descriptor,
 )
+from imbi.plugins.github.secret_provider import GitHubApp
 
 
 class GitHubWebhookActions(WebhookActionsCapability):
@@ -58,6 +60,13 @@ class GitHubWebhookActions(WebhookActionsCapability):
             sync_pull_requests_descriptor,
         ]
 
+    @classmethod
+    def signature(cls) -> WebhookSignature:
+        # The secret of the GitHub webhook is the Webhook.secret.
+        return WebhookSignature(
+            header='x-hub-signature-256', prefix='sha256=', secret='webhook'
+        )
+
 
 # Integration-level options, asked once per Integration.
 _OPTIONS: list[PluginOption] = [
@@ -418,4 +427,5 @@ class GitHubPlugin(Plugin):
             ),
         ],
         ops_log_templates=_OPS_LOG_TEMPLATES,
+        secret_providers=[GitHubApp],
     )

imbi/plugins/github/public.py

@@ -0,0 +1,84 @@
+"""Credential-free reads of a public ``github.com`` repository.
+
+:meth:`GitHubDeployment.public_reader
+<imbi.plugins.github.deployment.GitHubDeployment.public_reader>`
+returns a :class:`PublicRepository`. The host uses it when no
+Integration of the organization can read a repository, for example a
+public Claude Code plugin marketplace.
+"""
+
+import re
+import typing
+import urllib.parse
+
+import httpx
+
+from imbi.common.plugins import base
+
+_GITHUB_REPO = re.compile(r'[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+')
+
+
+class PublicRepository:
+    """The :class:`~imbi.common.plugins.base.RepositoryReader` of a public
+    ``github.com`` repository. It ignores ``ctx`` and ``credentials``."""
+
+    # ponytail: 60 unauthenticated requests an hour per API pod IP; use
+    # an org token if many public marketplaces sync often.
+    def __init__(self, owner: str, repo: str) -> None:
+        self.base = f'https://api.github.com/repos/{owner}/{repo}'
+
+    @classmethod
+    def for_url(cls, url: str) -> PublicRepository | None:
+        """Return the reader of a ``github.com`` repository URL, or
+        ``None`` for another host or a path that is not a repository."""
+        parts = urllib.parse.urlsplit(url)
+        path = parts.path.strip('/').removesuffix('.git')
+        if parts.hostname != 'github.com' or not _GITHUB_REPO.fullmatch(path):
+            return None
+        return cls(*path.split('/'))
+
+    async def _get(
+        self, path: str, accept: str = 'application/vnd.github+json'
+    ) -> httpx.Response:
+        # A renamed or moved repository answers 301 to /repositories/{id}.
+        async with httpx.AsyncClient(
+            timeout=30, follow_redirects=True
+        ) as client:
+            return await client.get(
+                f'{self.base}{path}', headers={'Accept': accept}
+            )
+
+    async def resolve_committish(
+        self, _ctx: object, _credentials: object, ref: str, /
+    ) -> base.Ref:
+        response = await self._get(f'/commits/{urllib.parse.quote(ref)}')
+        response.raise_for_status()
+        return base.Ref(name=ref, kind='branch', sha=response.json()['sha'])
+
+    async def list_refs(
+        self,
+        _ctx: object,
+        _credentials: object,
+        /,
+        kind: typing.Literal['default', 'branch', 'tag', 'all'] = 'all',
+    ) -> list[base.Ref]:
+        """Return the default branch only, whatever ``kind`` is."""
+        del kind
+        response = await self._get('')
+        response.raise_for_status()
+        branch = str(response.json()['default_branch'])
+        ref = await self.resolve_committish(None, None, branch)
+        return [ref.model_copy(update={'kind': 'default', 'is_default': True})]
+
+    async def get_file(
+        self, _ctx: object, _credentials: object, path: str, ref: str, /
+    ) -> str | None:
+        response = await self._get(
+            f'/contents/{urllib.parse.quote(path)}?'
+            f'{urllib.parse.urlencode({"ref": ref})}',
+            'application/vnd.github.raw+json',
+        )
+        if response.status_code == 404:
+            return None
+        response.raise_for_status()
+        return response.text

imbi/plugins/github/secret_provider.py

@@ -0,0 +1,734 @@
+"""The ``github_app`` secret provider (ADR 0022, plan section 9.8).
+
+The provider issues a GitHub App installation access token for each
+resolution. The token is limited to the repositories of the task and to
+the permissions of the purpose, and it lasts one hour at most. Release
+revokes it with ``DELETE /installation/token``.
+
+A binding without an ``installation_id`` finds the installation of the
+repositories with the App JWT (``GET /repos/{owner}/{repo}/installation``
+or ``GET /repositories/{id}/installation``), so one binding works in each
+org that the App is installed in. The repositories of one token must be
+in one installation.
+
+The App private key is not in Imbi: the binding names the ``secret://``
+reference of another binding (for example an ``aws_secrets_manager``
+binding), and imbi-api reads the key through the broker for each call
+(:meth:`SecretProviderHost.provider_key
+<imbi.common.plugins.secrets.SecretProviderHost.provider_key>`). That key
+binding must be marked as a provider key for the same host and App id,
+and must list the requesting binding as a consumer.
+
+The GitHub host comes from an allowlist, never from free tenant input:
+``github.com``, a GHEC tenant (``<tenant>.ghe.com``), or a GHES host that
+the operator lists in ``IMBI_SECRETS_GITHUB_GHES_HOSTS``. A JWT signed
+with an App key goes only to such a host.
+
+The JWT and the token exchange come from :mod:`._app_auth`. Its
+process-wide token cache is not used: each resolution gets its own
+token, so that release can revoke it.
+
+The lease id holds the token and the host it came from, because GitHub
+revokes a token only with the token itself, and only at that host. The
+broker keeps lease ids encrypted.
+"""
+
+import collections.abc
+import contextlib
+import datetime
+import ipaddress
+import logging
+import os
+import re
+import typing
+import uuid
+
+import httpx
+import jwt
+import orjson
+import pydantic
+
+from imbi.common import graph
+from imbi.common.plugins import secrets
+from imbi.plugins.github import _app_auth, _hosts, _repos
+from imbi.plugins.github.deployment import (
+    _accept_header,  # pyright: ignore[reportPrivateUsage]
+    _auth_headers,  # pyright: ignore[reportPrivateUsage]
+)
+
+LOGGER = logging.getLogger(__name__)
+
+#: The token permissions of each purpose. The App's own permissions are
+#: the upper limit: GitHub refuses a request for more (422).
+PURPOSE_PERMISSIONS: dict[str, dict[str, str]] = {
+    'workspace_checkout': {'contents': 'read'},
+    'marketplace_fetch': {'contents': 'read'},
+    'github_write': {
+        'contents': 'write',
+        'pull_requests': 'write',
+        'issues': 'write',
+    },
+}
+
+#: The binding test asks for the smallest permission set.
+_TEST_PERMISSIONS = {'metadata': 'read'}
+
+_TIMEOUT_SECONDS = 10.0
+#: When GitHub gives no expiry, assume less than its one hour.
+_DEFAULT_TTL = datetime.timedelta(minutes=55)
+_REPOSITORY = re.compile(r'[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+')
+_GHEC_TENANT = re.compile(r'[a-z0-9][a-z0-9-]*\.ghe\.com')
+_REPOSITORY_ID = re.compile(r'[0-9]{1,20}')
+#: The plugin of the Integrations that verify a project's repository.
+GITHUB_PLUGIN = 'github'
+#: The verified repository ids of a project, one row for each
+#: ``EXISTS_IN`` edge to a GitHub Integration. An edge whose
+#: identifier was changed by hand after verification does not count.
+_VERIFIED_REPOSITORIES: typing.LiteralString = (
+    'MATCH (:Project {{id: {project_id}}})-[ei:EXISTS_IN]->'
+    '(i:Integration {{plugin: {plugin}}}) '
+    'WHERE ei.verified_identifier = ei.identifier '
+    'RETURN i.options AS options, '
+    'ei.verified_identifier AS repository_id'
+)
+#: The operator's GHES hosts, comma separated. Never tenant input.
+GHES_HOSTS_ENV = 'IMBI_SECRETS_GITHUB_GHES_HOSTS'
+
+#: GitHub status codes, by safe reason code.
+_HTTP_REASONS = {
+    401: 'app_authentication_failed',
+    403: 'access_denied',
+    404: 'installation_not_found',
+    422: 'permission_or_repository_not_granted',
+}
+
+
+def _internal_address(host: str) -> bool:
+    """True for a private, loopback, link-local, or other non-public IP."""
+    try:
+        address = ipaddress.ip_address(host.strip('[]'))
+    except ValueError:
+        return False
+    return not address.is_global
+
+
+def ghes_hosts() -> frozenset[str]:
+    """The GHES hosts of :data:`GHES_HOSTS_ENV`, without IP addresses
+    that are not public."""
+    hosts: set[str] = set()
+    for raw in os.environ.get(GHES_HOSTS_ENV, '').split(','):
+        if not raw.strip():
+            continue
+        try:
+            host = _hosts.normalize_host(raw, GHES_HOSTS_ENV).lower()
+        except ValueError:
+            LOGGER.warning('%s: a value is not a host', GHES_HOSTS_ENV)
+            continue
+        if _internal_address(host):
+            LOGGER.warning(
+                '%s: %s is not a public address', GHES_HOSTS_ENV, host
+            )
+            continue
+        hosts.add(host)
+    return frozenset(hosts)
+
+
+def allowed_host(host: str) -> bool:
+    """True for github.com, a GHEC tenant, or an operator GHES host."""
+    return (
+        host == 'github.com'
+        or _GHEC_TENANT.fullmatch(host) is not None
+        or host in ghes_hosts()
+    )
+
+
+def check_host(value: str) -> str:
+    """Return the normalized host, or raise ``ValueError``."""
+    host = _hosts.normalize_host(value, 'host').lower()
+    if not allowed_host(host):
+        raise ValueError(
+            'use github.com, a <tenant>.ghe.com host, or a GHES host in '
+            + GHES_HOSTS_ENV
+        )
+    return host
+
+
+class _Config(pydantic.BaseModel):
+    """One provider for each GitHub host: github.com, a GHEC tenant
+    (``<tenant>.ghe.com``), or a GHES appliance."""
+
+    model_config = pydantic.ConfigDict(extra='forbid')
+
+    host: str = 'github.com'
+
+    @pydantic.field_validator('host')
+    @classmethod
+    def _host(cls, value: str) -> str:
+        return check_host(value)
+
+
+class _Locator(pydantic.BaseModel):
+    model_config = pydantic.ConfigDict(extra='forbid')
+
+    app_id: str = pydantic.Field(pattern=r'^[0-9]{1,20}$')
+    #: ``None``: find the installation of each request's repositories.
+    installation_id: str | None = pydantic.Field(
+        default=None, pattern=r'^[0-9]{1,20}$'
+    )
+    #: The ``secret://`` reference of the App private key (PEM, or
+    #: base64 PEM), in a binding that is not ``dynamic``.
+    private_key: str
+    #: ``owner/name`` repositories for ``marketplace_fetch``: the
+    #: marketplaces and their external plugins. Other purposes use the
+    #: repositories of the task's project.
+    repositories: list[str] = pydantic.Field(default_factory=list[str])
+
+    @pydantic.field_validator('private_key')
+    @classmethod
+    def _reference(cls, value: str) -> str:
+        try:
+            return str(secrets.parse_reference(value))
+        except secrets.BrokerError:
+            raise ValueError('not a valid secret:// reference') from None
+
+    @pydantic.field_validator('repositories')
+    @classmethod
+    def _repositories(cls, value: list[str]) -> list[str]:
+        if not all(_REPOSITORY.fullmatch(name) for name in value):
+            raise ValueError('use the owner/name form')
+        return value
+
+
+def _host(config: dict[str, typing.Any]) -> str:
+    return str(config.get('host', 'github.com'))
+
+
+def _api_base(host: str) -> str:
+    """The API base of an allowed host. The allowlist is checked again
+    at each call, because the operator list can change."""
+    if not allowed_host(host):
+        raise secrets.BrokerError('secret_access_denied', 'host_not_allowed')
+    return _hosts.host_to_api_base(host)
+
+
+def _lease(host: str, token: str) -> str:
+    return orjson.dumps({'host': host, 'token': token}).decode()
+
+
+@contextlib.contextmanager
+def _github_errors(code: str) -> collections.abc.Generator[None]:
+    """Translate a GitHub or key failure into a :class:`BrokerError`.
+
+    Only the status code and the exception type are read. A response
+    body, a header, or a key never goes into the error or the log.
+    """
+    try:
+        yield
+    except secrets.BrokerError:
+        raise
+    except httpx.HTTPStatusError as err:
+        status = err.response.status_code
+        LOGGER.warning('GitHub App call failed: HTTP %d', status)
+        if status == 429 or status >= 500:
+            raise secrets.BrokerError(
+                'secret_provider_unavailable', 'throttled'
+            ) from None
+        raise secrets.BrokerError(
+            code, _HTTP_REASONS.get(status, 'provider_error')
+        ) from None
+    except httpx.TransportError as err:
+        LOGGER.warning('GitHub App call failed: %s', type(err).__name__)
+        raise secrets.BrokerError(
+            'secret_provider_unavailable', 'unreachable'
+        ) from None
+    except (ValueError, TypeError, jwt.PyJWTError) as err:
+        LOGGER.warning('GitHub App key not usable: %s', type(err).__name__)
+        raise secrets.BrokerError(code, 'invalid_private_key') from None
+
+
+def _options(raw: object) -> dict[str, typing.Any]:
+    """Decode an Integration ``options`` value, as AGE returns it."""
+    parsed = graph.parse_agtype(raw)
+    if isinstance(parsed, str):
+        try:
+            parsed = orjson.loads(parsed)
+        except orjson.JSONDecodeError:
+            return {}
+    if isinstance(parsed, dict):
+        return typing.cast(dict[str, typing.Any], parsed)
+    return {}
+
+
+def _expiry(value: object) -> datetime.datetime:
+    if isinstance(value, str):
+        try:
+            parsed = datetime.datetime.fromisoformat(value)
+        except ValueError:
+            pass
+        else:
+            if parsed.tzinfo is None:
+                parsed = parsed.replace(tzinfo=datetime.UTC)
+            return parsed
+    return datetime.datetime.now(datetime.UTC) + _DEFAULT_TTL
+
+
+class GitHubApp(secrets.SecretProvider):
+    """GitHub App installation access tokens, one for each resolution."""
+
+    type = 'github_app'
+    label = 'GitHub App'
+    capabilities = frozenset[secrets.SecretCapability](
+        {'dynamic_issuance', 'lease_revocation', 'health_check'}
+    )
+
+    def validate_config(
+        self, config: dict[str, typing.Any]
+    ) -> dict[str, typing.Any]:
+        return secrets.validate_model(_Config, config)
+
+    def validate_locator(
+        self,
+        locator: dict[str, typing.Any],
+        credential_class: secrets.CredentialClass,
+    ) -> dict[str, typing.Any]:
+        if credential_class != 'dynamic':
+            raise secrets.InvalidConfiguration(
+                'A github_app binding is dynamic'
+            )
+        return secrets.validate_model(_Locator, locator)
+
+    def check_key_host(self, host: str) -> str:
+        return check_host(host)
+
+    def repository(
+        self, config: dict[str, typing.Any], url: str
+    ) -> tuple[str, str] | None:
+        host = _host(config)
+        found = _repos.parse_owner_repo(url, host)
+        return None if found is None else (host, f'{found[0]}/{found[1]}')
+
+    async def project_repository_ids(
+        self, host: str, project_id: str | None
+    ) -> list[int]:
+        """Return the verified GitHub repository ids of a project on ``host``.
+
+        Only the ``verified_identifier`` of an ``EXISTS_IN`` edge to a GitHub
+        Integration for ``host`` counts. The GitHub plugin writes it from the
+        GitHub API (the lifecycle plugin and the doctor repair). A project
+        link, or an edge identifier that a user edits, gives no access.
+
+        Raises:
+            BrokerError: ``project_repository_unverified`` when the project
+                has no verified repository on ``host``.
+
+        """
+        if project_id is None:
+            return []
+        records = await self.host.graph().execute(
+            _VERIFIED_REPOSITORIES,
+            {'project_id': project_id, 'plugin': GITHUB_PLUGIN},
+            ['options', 'repository_id'],
+        )
+        found: set[int] = set()
+        for record in records:
+            value = str(graph.parse_agtype(record.get('repository_id')) or '')
+            if _REPOSITORY_ID.fullmatch(value) is None:
+                continue
+            try:
+                integration_host = _hosts.flavor_host(
+                    _options(record.get('options')), 'github_app'
+                )
+            except ValueError:
+                continue
+            if integration_host.lower() == host:
+                found.add(int(value))
+        if not found:
+            raise secrets.BrokerError(
+                'secret_access_denied', 'project_repository_unverified'
+            )
+        return sorted(found)
+
+    async def check_locator(
+        self,
+        config: dict[str, typing.Any],
+        locator: dict[str, typing.Any],
+        organization_id: str,
+    ) -> None:
+        """The key binding must be a provider key for this host and App."""
+        try:
+            await self.host.check_provider_key(
+                organization_id,
+                locator['private_key'],
+                host=_host(config),
+                app_id=locator['app_id'],
+            )
+        except secrets.BrokerError as err:
+            raise secrets.InvalidConfiguration(
+                'private_key must name a provider key binding for host '
+                f'{_host(config)} and App {locator["app_id"]}',
+                code=err.reason,
+            ) from None
+
+    @contextlib.asynccontextmanager
+    async def _app_client(
+        self,
+        config: dict[str, typing.Any],
+        locator: dict[str, typing.Any],
+        organization_id: str,
+        *,
+        consumer: uuid.UUID | None,
+        task_id: uuid.UUID | None,
+    ) -> collections.abc.AsyncGenerator[httpx.AsyncClient]:
+        """A client that authenticates as the App (a JWT)."""
+        host = _host(config)
+        base = _api_base(host)
+        material = await self.host.provider_key(
+            organization_id,
+            locator['private_key'],
+            consumer=consumer,
+            host=host,
+            app_id=locator['app_id'],
+            task_id=task_id,
+        )
+        key = material.value.decode()
+        app_jwt = _app_auth._app_jwt(  # pyright: ignore[reportPrivateUsage]
+            locator['app_id'], key
+        )
+        async with httpx.AsyncClient(
+            base_url=base,
+            headers=_auth_headers(app_jwt),
+            timeout=_TIMEOUT_SECONDS,
+        ) as client:
+            yield client
+
+    async def _installation(
+        self, client: httpx.AsyncClient, installation_id: str
+    ) -> dict[str, typing.Any]:
+        response = await client.get(f'/app/installations/{installation_id}')
+        response.raise_for_status()
+        return typing.cast(dict[str, typing.Any], response.json())
+
+    async def _installation_for(
+        self,
+        client: httpx.AsyncClient,
+        repositories: list[str],
+        repository_ids: list[int] | None,
+    ) -> dict[str, typing.Any]:
+        """The one installation of the repositories.
+
+        Raises:
+            BrokerError: ``repositories_span_installations`` when two
+                repositories are in different installations.
+
+        """
+        paths = [f'/repos/{name}/installation' for name in repositories] + [
+            f'/repositories/{rid}/installation' for rid in repository_ids or []
+        ]
+        # ponytail: one lookup for each repository and resolution; cache
+        # by repository when this is too many GitHub calls.
+        found: dict[str, dict[str, typing.Any]] = {}
+        for path in paths:
+            response = await client.get(path)
+            response.raise_for_status()
+            installation = typing.cast(dict[str, typing.Any], response.json())
+            found[str(installation.get('id'))] = installation
+        if len(found) != 1:
+            raise secrets.BrokerError(
+                'secret_access_denied', 'repositories_span_installations'
+            )
+        return next(iter(found.values()))
+
+    async def _mint(
+        self,
+        client: httpx.AsyncClient,
+        installation_id: str,
+        permissions: dict[str, str],
+        repositories: list[str] | None = None,
+        repository_ids: list[int] | None = None,
+    ) -> tuple[str, datetime.datetime]:
+        token, expires_at = await _app_auth._mint(  # pyright: ignore[reportPrivateUsage]
+            client,
+            installation_id,
+            _app_auth.freeze_scope(permissions),
+            repositories,
+            repository_ids,
+        )
+        return token, _expiry(expires_at)
+
+    async def health(
+        self, config: dict[str, typing.Any], organization_id: str
+    ) -> secrets.Health:
+        """Check that the GitHub API answers. No credentials are used."""
+        try:
+            async with httpx.AsyncClient(
+                base_url=_api_base(_host(config)),
+                headers=_accept_header(),
+                timeout=_TIMEOUT_SECONDS,
+            ) as client:
+                response = await client.get('/meta')
+        except secrets.BrokerError as err:
+            return secrets.Health('unhealthy', err.reason)
+        except httpx.TransportError:
+            return secrets.Health('unhealthy', 'unreachable')
+        if response.status_code != 200:
+            return secrets.Health('unhealthy', 'provider_error')
+        return secrets.Health('healthy', identity={'host': _host(config)})
+
+    async def validate_binding(
+        self,
+        config: dict[str, typing.Any],
+        locator: dict[str, typing.Any],
+        organization_id: str,
+        binding_id: uuid.UUID | None = None,
+    ) -> dict[str, typing.Any]:
+        """Mint a token and return its metadata only, never the token.
+
+        The token has only ``metadata: read`` and is revoked before this
+        returns. Without an ``installation_id``, list the installations
+        of the App instead; no token is minted.
+        """
+        if not locator.get('installation_id'):
+            return await self._installations(
+                config, locator, organization_id, binding_id
+            )
+        with _github_errors('secret_materialization_failed'):
+            async with self._app_client(
+                config,
+                locator,
+                organization_id,
+                consumer=binding_id,
+                task_id=None,
+            ) as client:
+                installation = await self._installation(
+                    client, locator['installation_id']
+                )
+                token, expires_at = await self._mint(
+                    client, locator['installation_id'], _TEST_PERMISSIONS
+                )
+            try:
+                async with httpx.AsyncClient(
+                    base_url=_api_base(_host(config)),
+                    headers=_auth_headers(token),
+                    timeout=_TIMEOUT_SECONDS,
+                ) as client:
+                    response = await client.get(
+                        '/installation/repositories',
+                        params={'per_page': 100},
+                    )
+                    response.raise_for_status()
+                    listed = typing.cast(
+                        dict[str, typing.Any], response.json()
+                    )
+            finally:
+                await _revoke_token(_host(config), token)
+        return {
+            'app_slug': installation.get('app_slug'),
+            'installation_id': locator['installation_id'],
+            'account': _account(installation),
+            'permissions': installation.get('permissions') or {},
+            'repository_selection': installation.get('repository_selection'),
+            'repository_count': listed.get('total_count'),
+            'repositories': [
+                repo['full_name'] for repo in listed.get('repositories', [])
+            ],
+            'token_expires_at': expires_at.isoformat(),
+        }
+
+    async def _installations(
+        self,
+        config: dict[str, typing.Any],
+        locator: dict[str, typing.Any],
+        organization_id: str,
+        binding_id: uuid.UUID | None,
+    ) -> dict[str, typing.Any]:
+        """The App and the accounts it is installed on."""
+        with _github_errors('secret_materialization_failed'):
+            async with self._app_client(
+                config,
+                locator,
+                organization_id,
+                consumer=binding_id,
+                task_id=None,
+            ) as client:
+                app = await client.get('/app')
+                app.raise_for_status()
+                installations: list[dict[str, typing.Any]] = []
+                page = 1
+                while True:
+                    listed = await client.get(
+                        '/app/installations',
+                        params={'per_page': 100, 'page': page},
+                    )
+                    listed.raise_for_status()
+                    batch = typing.cast(
+                        list[dict[str, typing.Any]], listed.json()
+                    )
+                    installations.extend(batch)
+                    if len(batch) < 100:
+                        break
+                    page += 1
+        return {
+            'app_slug': typing.cast(dict[str, typing.Any], app.json()).get(
+                'slug'
+            ),
+            'installation_id': None,
+            'installations': [
+                {'id': str(i.get('id')), 'account': _account(i)}
+                for i in installations
+            ],
+        }
+
+    async def resolve(
+        self,
+        config: dict[str, typing.Any],
+        locator: dict[str, typing.Any],
+        field: str | None,
+        context: secrets.ResolveContext,
+    ) -> secrets.Material:
+        """Mint a token for the task's repositories and the purpose.
+
+        ``marketplace_fetch`` uses the repository that the runner asks
+        for, which must be in the ``repositories`` of the binding; with
+        none, all of them. The other purposes use the verified repository
+        ids of the task's project (:meth:`project_repository_ids`).
+
+        Raises:
+            BrokerError: The purpose is unknown, the task has no
+                verified repository, a repository is outside the
+                installation, or GitHub refused the request.
+
+        """
+        if field is not None:
+            raise secrets.BrokerError('secret_field_not_allowed')
+        permissions = PURPOSE_PERMISSIONS.get(context.purpose)
+        if permissions is None:
+            raise secrets.BrokerError(
+                'secret_access_denied', 'purpose_not_supported'
+            )
+        repositories: list[str] = []
+        repository_ids: list[int] | None = None
+        if context.purpose == 'marketplace_fetch':
+            repositories = list(locator.get('repositories', []))
+            if context.repository is not None:
+                if context.repository.lower() not in {
+                    name.lower() for name in repositories
+                }:
+                    raise secrets.BrokerError(
+                        'secret_access_denied', 'repository_not_allowed'
+                    )
+                repositories = [context.repository]
+        else:
+            repository_ids = await self.project_repository_ids(
+                _host(config), context.project_id
+            )
+        # An empty list never reaches GitHub: no repositories would give
+        # a token for every repository of the installation.
+        if not repositories and not repository_ids:
+            raise secrets.BrokerError(
+                'secret_access_denied', 'no_repositories'
+            )
+        with _github_errors('secret_materialization_failed'):
+            async with self._app_client(
+                config,
+                locator,
+                context.organization_id,
+                consumer=context.binding_id,
+                task_id=context.task_id,
+            ) as client:
+                installation_id = locator.get('installation_id')
+                installation = None
+                if not installation_id:
+                    installation = await self._installation_for(
+                        client, repositories, repository_ids
+                    )
+                    installation_id = str(installation['id'])
+                elif repositories:
+                    installation = await self._installation(
+                        client, installation_id
+                    )
+                names = None
+                if installation is not None and repositories:
+                    names = _names(installation, repositories)
+                token, expires_at = await self._mint(
+                    client,
+                    installation_id,
+                    permissions,
+                    names,
+                    repository_ids,
+                )
+        return secrets.Material(
+            token.encode(),
+            credential_expires_at=expires_at,
+            lease_id=_lease(_host(config), token),
+            revocable=True,
+        )
+
+    async def revoke(
+        self, config: dict[str, typing.Any], lease_id: str
+    ) -> None:
+        """Revoke a token at the host that issued it, from the lease.
+
+        The provider configuration is not used: its host can change
+        after the token was minted.
+        """
+        try:
+            lease = typing.cast(dict[str, str], orjson.loads(lease_id))
+            host, token = lease['host'], lease['token']
+        except (orjson.JSONDecodeError, KeyError, TypeError):
+            raise secrets.BrokerError(
+                'provider_revocation_failed', 'invalid_lease'
+            ) from None
+        await _revoke_token(host, token)
+
+
+async def _revoke_token(host: str, token: str) -> None:
+    """Revoke a token. A 401 means it no longer works: success."""
+    base = _api_base(host)
+    try:
+        async with httpx.AsyncClient(
+            base_url=base,
+            headers=_auth_headers(token),
+            timeout=_TIMEOUT_SECONDS,
+        ) as client:
+            response = await client.delete('/installation/token')
+    except httpx.TransportError as err:
+        LOGGER.warning('GitHub token revocation: %s', type(err).__name__)
+        raise secrets.BrokerError(
+            'provider_revocation_failed', 'unreachable'
+        ) from None
+    if response.status_code not in (204, 401):
+        LOGGER.warning(
+            'GitHub token revocation: HTTP %d', response.status_code
+        )
+        raise secrets.BrokerError(
+            'provider_revocation_failed', 'provider_error'
+        )
+
+
+def _names(
+    installation: dict[str, typing.Any], repositories: list[str]
+) -> list[str]:
+    """Return the repository names for the token request.
+
+    GitHub takes names without the owner, inside the installation's
+    account. A repository of another owner is refused here, because its
+    name could match a different repository of that account.
+    """
+    account = _account(installation)
+    names: list[str] = []
+    for repository in repositories:
+        owner, _, name = repository.partition('/')
+        if not account or owner.lower() != account.lower():
+            raise secrets.BrokerError(
+                'secret_access_denied', 'repository_outside_installation'
+            )
+        names.append(name)
+    return names
+
+
+def _account(installation: dict[str, typing.Any]) -> str:
+    """The login of the account that the App is installed on."""
+    account = typing.cast(
+        dict[str, typing.Any], installation.get('account') or {}
+    )
+    return str(account.get('login') or '')

{imbi_plugin_github-2.41.0.dist-info → imbi_plugin_github-2.43.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.41.0
+Version: 2.43.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.41.0
+Requires-Dist: imbi-common[databases]==2.43.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.41.0.dist-info → imbi_plugin_github-2.43.0.dist-info}/RECORD

@@ -4,13 +4,15 @@ imbi/plugins/github/_app_auth.py,sha256=qr3azBExZSI0vDIIKMKV8nSllJNKCJLKBXV86lIp
 imbi/plugins/github/_hosts.py,sha256=sYuE3f7934125VZ6GGTqm8t3sVa3m0DNt3jL9Hb8nM0,4014
 imbi/plugins/github/_repos.py,sha256=BeSwrpzQnFBtlUGW-eP7v6_gAcSaSkqObq-vhj5wcYA,6575
 imbi/plugins/github/commits.py,sha256=wHs_NUl4cmhfvD3WrnOCmqaaJS-Eku-E-lOMh6Cb8IU,71882
-imbi/plugins/github/deployment.py,sha256=pRlYWWIDr1bFkjX1CMWiI_cfRsk4raMNrligGoMsCbE,111061
+imbi/plugins/github/deployment.py,sha256=bC5qMvbO-N0f5DTNo7ObyZIUtN4cl8uyjHgpp57W5_Y,111242
 imbi/plugins/github/doctor.py,sha256=sIps9YyDFLva7JHyKJU0IkKSW8tiI-PArC0s1ytxv3w,33177
 imbi/plugins/github/identity.py,sha256=9t_e-_jUbQ1iL0Vb6vaK2d7bT1ki6pw9aWwc4ics6gI,10354
 imbi/plugins/github/lifecycle.py,sha256=KJSzB36zFqetQBY5HNXLsRGRoIwGhrBJ-I1mA8G9H_Q,37711
-imbi/plugins/github/plugin.py,sha256=JFSHpkU6u-A6bcpAdv0H6zS_Qm7r_W0Poz1XZ6TuNyg,15615
+imbi/plugins/github/plugin.py,sha256=KmAu1lrGX2tkaNqTd3GV9DwLaPd78ZrODGi6jUt2Z0c,15981
+imbi/plugins/github/public.py,sha256=GZnTLbj_Gl5sHWuRqFuajnoO2xPudNQumAt4h_uJpYw,3114
 imbi/plugins/github/pull_requests.py,sha256=FiHbjdGqghJ2Q1--d15XfOtpUe_KZE7hYRb8JLQ5U1I,13510
 imbi/plugins/github/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-imbi_plugin_github-2.41.0.dist-info/METADATA,sha256=HNOimCh3kasWhCiywedz4iAi7nTv4NyWqFL3QrGez1k,7618
-imbi_plugin_github-2.41.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-imbi_plugin_github-2.41.0.dist-info/RECORD,,
+imbi/plugins/github/secret_provider.py,sha256=83BQwbG6AuIlyCWAskkN5hrVbRc9X5UqQJl5qt7Pij0,27317
+imbi_plugin_github-2.43.0.dist-info/METADATA,sha256=IJBROVQR2tagTrCI0PddNXFWxlbGmcPZSkieQLVPQbQ,7618
+imbi_plugin_github-2.43.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+imbi_plugin_github-2.43.0.dist-info/RECORD,,

{imbi_plugin_github-2.41.0.dist-info → imbi_plugin_github-2.43.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.4
+Generator: hatchling 1.33.0
 Root-Is-Purelib: true
 Tag: py3-none-any