imbi-plugin-github 2.42.0__tar.gz → 2.43.0__tar.gz

{imbi_plugin_github-2.42.0 → imbi_plugin_github-2.43.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-plugin-github
-Version: 2.42.0
+Version: 2.43.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.42.0
+Requires-Dist: imbi-common[databases]==2.43.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.42.0 → imbi_plugin_github-2.43.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.42.0"
+version = "2.43.0"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.42.0",
+  "imbi-common[databases]==2.43.0",
   "pydantic>=2",
   "pyjwt[crypto]>=2.8",
 ]

{imbi_plugin_github-2.42.0 → imbi_plugin_github-2.43.0}/src/imbi/plugins/github/deployment.py

@@ -65,6 +65,7 @@ from imbi.common.plugins.base import (
     WorkflowFile,
 )
 from imbi.common.plugins.errors import PluginAuthenticationFailed
+from imbi.plugins.github import public
 from imbi.plugins.github._hosts import flavor_host, host_to_api_base
 from imbi.plugins.github._repos import (
     derive_owner_repo_from_links,
@@ -654,6 +655,10 @@ class GitHubDeployment(DeploymentCapability):
     per call.
     """
 
+    @classmethod
+    def public_reader(cls, url: str) -> public.PublicRepository | None:
+        return public.PublicRepository.for_url(url)
+
     def _resolve_host(self, ctx: PluginContext) -> str:
         return flavor_host(ctx.integration_options, 'github deployment')
 

{imbi_plugin_github-2.42.0 → imbi_plugin_github-2.43.0}/src/imbi/plugins/github/plugin.py

@@ -25,6 +25,7 @@ from imbi.common.plugins.base import (
     PluginManifest,
     PluginOption,
     WebhookActionsCapability,
+    WebhookSignature,
 )
 from imbi.plugins.github.commits import (
     GitHubCommitSync,
@@ -39,6 +40,7 @@ from imbi.plugins.github.pull_requests import (
     GitHubPullRequestSync,
     sync_pull_requests_descriptor,
 )
+from imbi.plugins.github.secret_provider import GitHubApp
 
 
 class GitHubWebhookActions(WebhookActionsCapability):
@@ -58,6 +60,13 @@ class GitHubWebhookActions(WebhookActionsCapability):
             sync_pull_requests_descriptor,
         ]
 
+    @classmethod
+    def signature(cls) -> WebhookSignature:
+        # The secret of the GitHub webhook is the Webhook.secret.
+        return WebhookSignature(
+            header='x-hub-signature-256', prefix='sha256=', secret='webhook'
+        )
+
 
 # Integration-level options, asked once per Integration.
 _OPTIONS: list[PluginOption] = [
@@ -418,4 +427,5 @@ class GitHubPlugin(Plugin):
             ),
         ],
         ops_log_templates=_OPS_LOG_TEMPLATES,
+        secret_providers=[GitHubApp],
     )

imbi_plugin_github-2.43.0/src/imbi/plugins/github/public.py

@@ -0,0 +1,84 @@
+"""Credential-free reads of a public ``github.com`` repository.
+
+:meth:`GitHubDeployment.public_reader
+<imbi.plugins.github.deployment.GitHubDeployment.public_reader>`
+returns a :class:`PublicRepository`. The host uses it when no
+Integration of the organization can read a repository, for example a
+public Claude Code plugin marketplace.
+"""
+
+import re
+import typing
+import urllib.parse
+
+import httpx
+
+from imbi.common.plugins import base
+
+_GITHUB_REPO = re.compile(r'[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+')
+
+
+class PublicRepository:
+    """The :class:`~imbi.common.plugins.base.RepositoryReader` of a public
+    ``github.com`` repository. It ignores ``ctx`` and ``credentials``."""
+
+    # ponytail: 60 unauthenticated requests an hour per API pod IP; use
+    # an org token if many public marketplaces sync often.
+    def __init__(self, owner: str, repo: str) -> None:
+        self.base = f'https://api.github.com/repos/{owner}/{repo}'
+
+    @classmethod
+    def for_url(cls, url: str) -> PublicRepository | None:
+        """Return the reader of a ``github.com`` repository URL, or
+        ``None`` for another host or a path that is not a repository."""
+        parts = urllib.parse.urlsplit(url)
+        path = parts.path.strip('/').removesuffix('.git')
+        if parts.hostname != 'github.com' or not _GITHUB_REPO.fullmatch(path):
+            return None
+        return cls(*path.split('/'))
+
+    async def _get(
+        self, path: str, accept: str = 'application/vnd.github+json'
+    ) -> httpx.Response:
+        # A renamed or moved repository answers 301 to /repositories/{id}.
+        async with httpx.AsyncClient(
+            timeout=30, follow_redirects=True
+        ) as client:
+            return await client.get(
+                f'{self.base}{path}', headers={'Accept': accept}
+            )
+
+    async def resolve_committish(
+        self, _ctx: object, _credentials: object, ref: str, /
+    ) -> base.Ref:
+        response = await self._get(f'/commits/{urllib.parse.quote(ref)}')
+        response.raise_for_status()
+        return base.Ref(name=ref, kind='branch', sha=response.json()['sha'])
+
+    async def list_refs(
+        self,
+        _ctx: object,
+        _credentials: object,
+        /,
+        kind: typing.Literal['default', 'branch', 'tag', 'all'] = 'all',
+    ) -> list[base.Ref]:
+        """Return the default branch only, whatever ``kind`` is."""
+        del kind
+        response = await self._get('')
+        response.raise_for_status()
+        branch = str(response.json()['default_branch'])
+        ref = await self.resolve_committish(None, None, branch)
+        return [ref.model_copy(update={'kind': 'default', 'is_default': True})]
+
+    async def get_file(
+        self, _ctx: object, _credentials: object, path: str, ref: str, /
+    ) -> str | None:
+        response = await self._get(
+            f'/contents/{urllib.parse.quote(path)}?'
+            f'{urllib.parse.urlencode({"ref": ref})}',
+            'application/vnd.github.raw+json',
+        )
+        if response.status_code == 404:
+            return None
+        response.raise_for_status()
+        return response.text