imbi-plugin-github 2.9.0__py3-none-any.whl → 2.9.2__py3-none-any.whl

imbi_plugin_github/_app_auth.py

@@ -0,0 +1,195 @@
+"""GitHub App installation-token minting for webhook actions.
+
+The commit-sync webhook plugin has no acting user, so when it is
+configured with GitHub App credentials (``app_id`` + ``private_key``) it
+mints a short-lived *installation* access token per call instead of
+carrying a static PAT.  Tokens are cached process-wide until shortly
+before they expire, so a busy org makes one token-exchange round-trip
+per hour per ``(app, installation, host)`` rather than one per webhook
+delivery.
+
+All three GitHub flavors work unchanged: the caller resolves the API
+base via :func:`imbi_plugin_github._hosts.host_to_api_base` and passes
+it in, so the JWT exchange hits ``api.github.com``,
+``api.<tenant>.ghe.com``, or ``<ghes>/api/v3`` as appropriate.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import datetime
+import logging
+import time
+import typing
+
+import httpx
+import jwt
+
+from imbi_plugin_github.deployment import (
+    _auth_headers,  # pyright: ignore[reportPrivateUsage]
+    _raise_on_401,  # pyright: ignore[reportPrivateUsage]
+)
+
+LOGGER = logging.getLogger(__name__)
+
+_HTTP_TIMEOUT_SECONDS = 10.0
+# GitHub rejects an App JWT whose ``exp`` is more than 10 minutes out;
+# sign for 9 to leave room for clock skew between us and GitHub.
+_JWT_TTL_SECONDS = 540
+# Re-mint an installation token this many seconds before it actually
+# expires so an in-flight request never races the expiry boundary.
+_TOKEN_REFRESH_MARGIN_SECONDS = 300.0
+# Installation tokens last an hour; assume ~55 minutes when GitHub omits
+# (or we can't parse) the ``expires_at`` field.
+_DEFAULT_TOKEN_TTL_SECONDS = 3300.0
+
+# Process-wide caches.  Token cache values are ``(token, deadline)`` where
+# ``deadline`` is a ``time.monotonic()`` instant; the installation cache
+# avoids re-discovering the installation id on every delivery.
+_TOKEN_CACHE: dict[tuple[str, str, str], tuple[str, float]] = {}
+_INSTALL_CACHE: dict[tuple[str, str, str, str], str] = {}
+
+
+def reset_cache() -> None:
+    """Clear the process-wide token / installation caches (tests)."""
+    _TOKEN_CACHE.clear()
+    _INSTALL_CACHE.clear()
+
+
+def _load_private_key(raw: str) -> str:
+    """Return a PEM private key from raw PEM or a base64-encoded PEM.
+
+    Operators may paste the key GitHub generated directly, or a
+    single-line base64 encoding of it (handy where the config UI lacks a
+    multi-line field).  Raises ``ValueError`` for anything else.
+    """
+    value = raw.strip()
+    if '-----BEGIN' in value:
+        return value
+    try:
+        decoded = base64.b64decode(value, validate=True).decode('utf-8')
+    except (binascii.Error, ValueError, UnicodeDecodeError) as exc:
+        raise ValueError(
+            'github-commit-sync private_key is neither a PEM nor a '
+            'base64-encoded PEM'
+        ) from exc
+    if '-----BEGIN' not in decoded:
+        raise ValueError(
+            'github-commit-sync private_key decoded but is not a PEM'
+        )
+    return decoded
+
+
+def _app_jwt(app_id: str, private_key: str) -> str:
+    now = int(time.time())
+    return jwt.encode(
+        {'iat': now - 60, 'exp': now + _JWT_TTL_SECONDS, 'iss': app_id},
+        _load_private_key(private_key),
+        algorithm='RS256',
+    )
+
+
+def _token_deadline(expires_at: object) -> float:
+    """Map GitHub's ISO ``expires_at`` to a monotonic cache deadline."""
+    now = time.monotonic()
+    if not isinstance(expires_at, str):
+        return now + _DEFAULT_TOKEN_TTL_SECONDS
+    try:
+        exp = datetime.datetime.fromisoformat(expires_at)
+    except ValueError:
+        return now + _DEFAULT_TOKEN_TTL_SECONDS
+    remaining = (exp - datetime.datetime.now(datetime.UTC)).total_seconds()
+    return now + max(0.0, remaining - _TOKEN_REFRESH_MARGIN_SECONDS)
+
+
+def _cached_token(key: tuple[str, str, str]) -> str | None:
+    entry = _TOKEN_CACHE.get(key)
+    if entry is not None and entry[1] > time.monotonic():
+        return entry[0]
+    return None
+
+
+async def _discover_installation_id(
+    client: httpx.AsyncClient, owner: str, repo: str
+) -> str:
+    resp = await client.get(f'/repos/{owner}/{repo}/installation')
+    resp.raise_for_status()
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    install_id = data.get('id')
+    if install_id is None:
+        raise ValueError(
+            f'no GitHub App installation found for {owner}/{repo}'
+        )
+    return str(install_id)
+
+
+async def _mint(
+    client: httpx.AsyncClient, installation_id: str
+) -> tuple[str, object]:
+    resp = await client.post(
+        f'/app/installations/{installation_id}/access_tokens'
+    )
+    resp.raise_for_status()
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    return str(data['token']), data.get('expires_at')
+
+
+async def installation_token(
+    *,
+    base: str,
+    app_id: str,
+    private_key: str,
+    installation_id: str | None,
+    owner: str,
+    repo: str,
+) -> str:
+    """Return a valid installation token, minting/caching as needed.
+
+    ``installation_id`` may be ``None``, in which case the installation
+    is discovered from the target repo (and cached).  The resulting
+    token is cached until shortly before it expires.
+    """
+    install = installation_id
+    if install is not None and (
+        cached := _cached_token((app_id, install, base))
+    ):
+        return cached
+    if install is None:
+        install = _INSTALL_CACHE.get((app_id, base, owner, repo))
+        if install is not None and (
+            cached := _cached_token((app_id, install, base))
+        ):
+            return cached
+
+    install_was_cached = install is not None and installation_id is None
+    app_token = _app_jwt(app_id, private_key)
+    async with httpx.AsyncClient(
+        base_url=base,
+        headers=_auth_headers(app_token),
+        timeout=_HTTP_TIMEOUT_SECONDS,
+        event_hooks={'response': [_raise_on_401]},
+    ) as client:
+        if install is None:
+            install = await _discover_installation_id(client, owner, repo)
+            _INSTALL_CACHE[(app_id, base, owner, repo)] = install
+            if cached := _cached_token((app_id, install, base)):
+                return cached
+        try:
+            token, expires_at = await _mint(client, install)
+        except httpx.HTTPStatusError as exc:
+            # A 404 (or 401, surfaced as PluginAuthenticationFailed by the
+            # response hook) against a *cached* installation id means the
+            # app was uninstalled/reinstalled or transferred. Evict the
+            # stale id and rediscover once before giving up.
+            if not install_was_cached or exc.response.status_code != 404:
+                raise
+            _INSTALL_CACHE.pop((app_id, base, owner, repo), None)
+            install = await _discover_installation_id(client, owner, repo)
+            _INSTALL_CACHE[(app_id, base, owner, repo)] = install
+            token, expires_at = await _mint(client, install)
+    _TOKEN_CACHE[(app_id, install, base)] = (
+        token,
+        _token_deadline(expires_at),
+    )
+    return token

imbi_plugin_github/commits.py

@@ -18,6 +18,12 @@ order:
 4. the push payload's ``repository.url`` (already the flavor-correct API
    URL) as a last resort.
 
+The same plugin also exposes :meth:`GitHubCommitSyncPlugin.sync_all_history`
+for an on-demand, host-invoked backfill: there is no push payload, so the
+GitHub host is read from ``ctx.service_plugins`` and ``(owner, repo)`` from
+the project links; it walks the full default-branch history and the
+complete tag list rather than a single push delta.
+
 Commit / tag rows are written to the shared ClickHouse ``commits`` /
 ``tags`` tables via :func:`imbi_common.clickhouse.insert`. Writes are
 best-effort: a storage failure is logged and swallowed so an analytics
@@ -47,11 +53,13 @@ from imbi_common.plugins.base import (
     WebhookActionPlugin,
 )
 
+from imbi_plugin_github import _app_auth
 from imbi_plugin_github._hosts import (
     host_to_api_base,
     normalize_host,
     require_ghec_tenant_host,
 )
+from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
     _next_page_url,  # pyright: ignore[reportPrivateUsage]
@@ -65,21 +73,51 @@ LOGGER = logging.getLogger(__name__)
 
 _HTTP_TIMEOUT_SECONDS = 10.0
 _ZERO_SHA = '0' * 40
+# This plugin's own slug; skipped when reading the GitHub host/flavor
+# from connected ``service_plugins`` so the commit-sync entry can't
+# masquerade as a github.com host on a GHEC/GHES service.
+_SELF_SLUG = 'github-commit-sync'
 # GitHub's compare endpoint caps ``commits[]`` at 250 per page and
 # paginates the rest; bound the walk so a pathological single push
 # (force-push of thousands of commits) can't pin us on one endpoint.
 # 250 * 20 = 5000 commits is far more than any realistic push.
 _MAX_COMPARE_PAGES = 20
-
-
-def _token(credentials: dict[str, str]) -> str:
+# On-demand full-history sync walks ``GET /commits`` from the default
+# branch head.  100 per page * 100 pages = 10k commits caps a one-shot
+# backfill so a very deep repo can't pin the worker indefinitely; the
+# walk logs a truncation warning when it hits the cap.
+_MAX_HISTORY_PAGES = 100
+
+
+async def _resolve_bearer(
+    credentials: dict[str, str], base: str, owner: str, repo: str
+) -> str:
+    """Resolve the Bearer token used for the repo's GitHub API calls.
+
+    Prefers an explicit PAT (``access_token``/``token``).  Otherwise
+    mints a short-lived GitHub App installation token from ``app_id`` +
+    ``private_key`` (with an optional ``installation_id`` that skips
+    per-repo installation discovery).  Tokens are cached process-wide by
+    :mod:`imbi_plugin_github._app_auth`.
+    """
     token = credentials.get('access_token') or credentials.get('token')
-    if not token:
-        raise ValueError(
-            'github-commit-sync requires a service token; expected '
-            "``credentials['access_token']``"
+    if token:
+        return token
+    app_id = credentials.get('app_id')
+    private_key = credentials.get('private_key')
+    if app_id and private_key:
+        return await _app_auth.installation_token(
+            base=base,
+            app_id=app_id,
+            private_key=private_key,
+            installation_id=credentials.get('installation_id') or None,
+            owner=owner,
+            repo=repo,
         )
-    return token
+    raise ValueError(
+        'github-commit-sync requires either an access_token (PAT) or '
+        'app_id + private_key (GitHub App) credentials'
+    )
 
 
 def _resolve(pointer: jsonpointer.JsonPointer, payload: object) -> object:
@@ -150,6 +188,11 @@ def _resolve_api_base(
     if explicit:
         return explicit.rstrip('/')
     for plugin in ctx.service_plugins:
+        # Skip our own entry: its slug starts with "github" but carries
+        # no host option, so _github_plugin_host would mis-resolve it to
+        # github.com on a GHEC/GHES service.
+        if plugin.slug == _SELF_SLUG:
+            continue
         host = _github_plugin_host(plugin)
         if host:
             return host_to_api_base(host)
@@ -324,6 +367,93 @@ async def _fetch_recent_commits(
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
 
 
+def _resolve_host_for_context(ctx: PluginContext) -> str | None:
+    """Resolve the GitHub web host for an on-demand sync (no payload).
+
+    Walks the connected GitHub plugins on ``ctx.service_plugins`` and
+    returns the first usable host (github.com, a GHEC tenant, or a GHES
+    appliance), skipping this plugin's own entry so a commit-sync row on a
+    GHEC/GHES service can't be read as github.com.  Unlike the webhook
+    path there is no push payload to fall back to, so the absence of a
+    connected GitHub plugin yields ``None``.
+    """
+    for plugin in ctx.service_plugins:
+        if plugin.slug == _SELF_SLUG:
+            continue
+        host = _github_plugin_host(plugin)
+        if host:
+            return host
+    return None
+
+
+async def _fetch_default_branch(client: httpx.AsyncClient) -> str:
+    """Return the repo's default branch name (``main`` when unknown)."""
+    # httpx normalises ``base_url`` with a trailing slash; GHEC's gateway
+    # 404s on ``/repos/<o>/<r>/`` so request the absolute URL with the
+    # trailing slash stripped, matching the deployment plugin.
+    url = str(client.base_url).rstrip('/')
+    resp = await client.get(url)
+    resp.raise_for_status()
+    meta = typing.cast('dict[str, typing.Any]', resp.json())
+    return str(meta.get('default_branch') or 'main')
+
+
+async def _fetch_all_commits(
+    client: httpx.AsyncClient, branch: str
+) -> list[dict[str, typing.Any]]:
+    """Walk every commit reachable from ``branch`` via Link pagination.
+
+    Capped at ``_MAX_HISTORY_PAGES`` (logged on truncation) so a very deep
+    repo can't pin a one-shot backfill indefinitely.
+    """
+    params: dict[str, str] = {'sha': branch, 'per_page': '100'}
+    out: list[dict[str, typing.Any]] = []
+    for page in range(1, _MAX_HISTORY_PAGES + 1):
+        resp = await client.get('/commits', params=params)
+        resp.raise_for_status()
+        out.extend(typing.cast('list[dict[str, typing.Any]]', resp.json()))
+        next_url = _next_page_url(resp.headers.get('link'))
+        if next_url is None:
+            return out
+        next_page = _query_param(next_url, 'page')
+        if next_page is None:
+            return out
+        params['page'] = next_page
+        if page == _MAX_HISTORY_PAGES:
+            LOGGER.warning(
+                'github-commit-sync truncated history at %d pages (%d '
+                'commits); older commits will not be recorded',
+                _MAX_HISTORY_PAGES,
+                len(out),
+            )
+    return out
+
+
+async def _insert_best_effort(
+    table: str, records: list[pydantic.BaseModel], project_id: str
+) -> int:
+    """Insert ``records`` into ``table``; return rows written (0 on fail).
+
+    ``imbi_common.clickhouse.insert`` rejects an empty list, so an empty
+    set short-circuits to 0.  A storage failure is logged and swallowed,
+    mirroring the webhook actions -- an analytics hiccup must not fail the
+    sync.
+    """
+    if not records:
+        return 0
+    try:
+        await clickhouse.insert(table, records)
+    except Exception:
+        LOGGER.exception(
+            'github-commit-sync: failed to record %d %s rows for project %s',
+            len(records),
+            table,
+            project_id,
+        )
+        return 0
+    return len(records)
+
+
 class SyncCommitsConfig(pydantic.BaseModel):
     """``WebhookRule.handler_config`` for ``sync_commits``."""
 
@@ -394,7 +524,8 @@ async def sync_commits(
     ref = _branch_short_name(ref_raw if isinstance(ref_raw, str) else '')
     before = _resolve(action_config.before_selector, payload)
     pushed_at = datetime.datetime.now(datetime.UTC)
-    async with _client(base, owner, repo, _token(credentials)) as client:
+    token = await _resolve_bearer(credentials, base, owner, repo)
+    async with _client(base, owner, repo, token) as client:
         if isinstance(before, str) and before and before != _ZERO_SHA:
             raw = await _fetch_compare_commits(client, before, after)
         else:
@@ -510,7 +641,8 @@ async def sync_tags(
     if resolved is None:
         return
     owner, repo, base = resolved
-    async with _client(base, owner, repo, _token(credentials)) as client:
+    token = await _resolve_bearer(credentials, base, owner, repo)
+    async with _client(base, owner, repo, token) as client:
         annotated = await _annotated_tag(client, after)
         records: list[pydantic.BaseModel] = [
             _tag_record(
@@ -566,9 +698,15 @@ sync_tags_descriptor = ActionDescriptor(
 class GitHubCommitSyncPlugin(WebhookActionPlugin):
     """Webhook-action plugin syncing GitHub commit / tag history.
 
-    Declares its own ``access_token`` service credential -- it is *not*
-    folded into the identity / deployment / lifecycle plugins, which run
-    as the acting user and carry no service token.
+    Carries its own service credential -- it is *not* folded into the
+    identity / deployment / lifecycle plugins, which run as the acting
+    user.  Two mutually exclusive auth modes are supported (resolved by
+    :func:`_resolve_bearer`):
+
+    * **PAT** -- a static ``access_token``.
+    * **GitHub App** -- ``app_id`` + ``private_key`` (raw or base64 PEM),
+      with an optional ``installation_id``; the plugin mints a
+      short-lived installation token per call and caches it.
     """
 
     manifest = PluginManifest(
@@ -582,12 +720,101 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         credentials=[
             CredentialField(
                 name='access_token',
-                label='GitHub Token',
-                description='Service token used to fetch commit history.',
-            )
+                label='GitHub Token (PAT)',
+                description=(
+                    'Static personal/service access token. Use this *or* '
+                    'the GitHub App fields below.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='app_id',
+                label='GitHub App ID',
+                description=(
+                    'GitHub App identifier; with a private key the plugin '
+                    'mints short-lived installation tokens.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='private_key',
+                label='GitHub App Private Key',
+                description=(
+                    'App private key, raw PEM or base64-encoded PEM.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='installation_id',
+                label='GitHub App Installation ID',
+                description=(
+                    'Optional. When unset, the installation is discovered '
+                    'from the pushed repository.'
+                ),
+                required=False,
+            ),
         ],
     )
 
     @classmethod
     def actions(cls) -> list[ActionDescriptor]:
         return [sync_commits_descriptor, sync_tags_descriptor]
+
+    async def sync_all_history(
+        self,
+        *,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+    ) -> tuple[int, int]:
+        """Record the project's full default-branch history and all tags.
+
+        Host-invoked (no webhook payload): the host instantiates the
+        plugin, builds a :class:`PluginContext` carrying the project's
+        links and the connected ``service_plugins``, resolves this
+        plugin's service ``credentials``, and awaits this method.  The
+        GitHub host/flavor is read from ``service_plugins``, the
+        ``(owner, repo)`` from the project links, and the bearer token
+        from the same PAT-or-App resolution the webhook actions use.
+
+        Walks every commit reachable from the default branch head plus the
+        repo's complete (lightweight) tag list, maps them onto
+        ``CommitRecord`` / ``TagRecord``, and upserts into the ClickHouse
+        ``commits`` / ``tags`` tables.  ``ReplacingMergeTree`` dedupes
+        against rows the webhook already recorded, so re-running is safe.
+
+        Returns ``(commits_recorded, tags_recorded)``.  Raises
+        :class:`ValueError` only when the host or repository can't be
+        resolved; ClickHouse failures are swallowed (the count reflects
+        what was written).
+        """
+        host = _resolve_host_for_context(ctx)
+        if host is None:
+            raise ValueError(
+                'github-commit-sync could not resolve a GitHub host for an '
+                'on-demand sync: connect a GitHub plugin to the service'
+            )
+        base = host_to_api_base(host)
+        owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')
+        pushed_at = datetime.datetime.now(datetime.UTC)
+        token = await _resolve_bearer(credentials, base, owner, repo)
+        async with _client(base, owner, repo, token) as client:
+            branch = await _fetch_default_branch(client)
+            raw_commits = await _fetch_all_commits(client, branch)
+            tags = await _reconcile_tags(client, ctx.project_id)
+        commit_records: list[pydantic.BaseModel] = [
+            _commit_record(
+                item,
+                project_id=ctx.project_id,
+                ref=branch,
+                pushed_at=pushed_at,
+            )
+            for item in raw_commits
+            if item.get('sha')
+        ]
+        commits_recorded = await _insert_best_effort(
+            'commits', commit_records, ctx.project_id
+        )
+        tags_recorded = await _insert_best_effort(
+            'tags', list(tags), ctx.project_id
+        )
+        return commits_recorded, tags_recorded

{imbi_plugin_github-2.9.0.dist-info → imbi_plugin_github-2.9.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.9.0
+Version: 2.9.2
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,8 +13,9 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.9.0
+Requires-Dist: imbi-common[databases]==2.9.2
 Requires-Dist: pydantic>=2
+Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown
 
 # imbi-plugin-github
@@ -30,6 +31,7 @@ projects to the right backend.
 | Identity   | `github`, `github-enterprise-cloud`, `github-enterprise-server`      |
 | Deployment | `github-deployment`, `github-deployment-ec`, `github-deployment-es`  |
 | Lifecycle  | `github-lifecycle`, `github-lifecycle-ec`, `github-lifecycle-es`     |
+| Webhook    | `github-commit-sync`                                                  |
 
 ### Identity
 
@@ -63,6 +65,37 @@ org.
 Archiving requires admin scope on the repo; transferring additionally
 requires admin permission on the target organization.
 
+### Webhook (commit / tag sync)
+
+A single `github-commit-sync` webhook-action plugin exposes two actions
+the gateway dispatches on `push` deliveries:
+
+| Action         | Handler                          | Records into ClickHouse |
+| -------------- | -------------------------------- | ----------------------- |
+| `sync_commits` | `github-commit-sync#sync_commits`| `commits`               |
+| `sync_tags`    | `github-commit-sync#sync_tags`   | `tags`                  |
+
+`sync_commits` fetches the full set of commits in a push via the compare
+API (paginated, so it isn't capped by the 20-commit inline payload limit);
+`sync_tags` records the pushed tag and, with `reconcile_all`, the repo's
+full tag list. Branch/tag gating is the rule's CEL `filter_expression`
+(e.g. `ref == "refs/heads/main"`, `ref.startsWith("refs/tags/")`). The API
+flavor (github.com / GHEC / GHES) is resolved at runtime — explicit
+`api_base_url`, else a connected GitHub plugin on the same service, else
+the service endpoint, else the payload's `repository.url`.
+
+Unlike identity/deployment/lifecycle (which act as the OAuth user),
+commit-sync runs without an actor and authenticates with a **service**
+credential in one of two modes, resolved per call:
+
+- **PAT** — a static `access_token`.
+- **GitHub App** — `app_id` + `private_key`; the plugin signs an App JWT
+  and mints a short-lived **installation token** (cached process-wide
+  until shortly before it expires), so no static, expiring token is
+  stored. `installation_id` is optional — when unset it is discovered
+  from the pushed repository (`GET /repos/{owner}/{repo}/installation`).
+  The App needs **Contents: Read-only**.
+
 ## Manifest options (identity)
 
 | Option           | Required  | Description                                                                |
@@ -77,6 +110,18 @@ requires admin permission on the target organization.
 | `client_id`      | yes      |
 | `client_secret`  | yes      |
 
+## Credentials (commit-sync)
+
+Provide **either** the PAT field **or** the GitHub App fields (all
+individually optional; validated per call):
+
+| Field             | Mode | Description                                            |
+| ----------------- | ---- | ------------------------------------------------------ |
+| `access_token`    | PAT  | Static personal/service token.                         |
+| `app_id`          | App  | GitHub App identifier.                                 |
+| `private_key`     | App  | App private key — raw PEM or base64-encoded PEM.       |
+| `installation_id` | App  | Optional; discovered from the repo when unset.         |
+
 ## License
 
 BSD-3-Clause.

{imbi_plugin_github-2.9.0.dist-info → imbi_plugin_github-2.9.2.dist-info}/RECORD

@@ -1,12 +1,13 @@
 imbi_plugin_github/__init__.py,sha256=8ZVhm8XpGqgYRUtpHl0uuZTT3gmMyHNhKd9k6qoatB4,298
+imbi_plugin_github/_app_auth.py,sha256=LnLrvqmu2UC27uHHJfIzFPNDh33RtgeOX1RXceX9Pj0,7000
 imbi_plugin_github/_hosts.py,sha256=jQ1Z6yEpjAa4b7LocLfEelnBcRYYQLNLBNCdWZtAXUc,2258
 imbi_plugin_github/_repos.py,sha256=agp4ZgRuqbrGBRMFeHomnUf1HvvaNvapBCWHQebdviQ,4559
-imbi_plugin_github/commits.py,sha256=Foz2c3YaL0Iil6RkwPEf-BH8-wm1Vz61p9CtFLDk_CE,20479
+imbi_plugin_github/commits.py,sha256=okoJd6GM_YlkqyJb3mHlxz58JU7Ar8ve8bQcDkTrkRI,29939
 imbi_plugin_github/deployment.py,sha256=V6YlZX24m33BPJWkC-vCZZLSsH71etkl0xkhkDsKASg,47914
 imbi_plugin_github/identity.py,sha256=RSs1cLQpZmfyQ_0KQkohDIZEBYVBnre6RJIt166EtdQ,15525
 imbi_plugin_github/lifecycle.py,sha256=48mLKjFPG7BOanpA7jWnmbWOdsDLh1F39g2AoxDLL7M,33211
-imbi_plugin_github-2.9.0.dist-info/METADATA,sha256=AdkNjhDiuyHFAr42DpWqbuHlnHTklB53gMBnor-9MGI,3355
-imbi_plugin_github-2.9.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-imbi_plugin_github-2.9.0.dist-info/entry_points.txt,sha256=RavN_FYCeS97iauHgCG3tHFdVULbEMXmQfvgCgLeGkI,805
-imbi_plugin_github-2.9.0.dist-info/licenses/LICENSE,sha256=el9B20zOqEcv_mRrHgbdkVyxSC6I8np7am0D6mO2A9Y,1491
-imbi_plugin_github-2.9.0.dist-info/RECORD,,
+imbi_plugin_github-2.9.2.dist-info/METADATA,sha256=ACIhGSJ7VSQL2O-v0SmxRAqfov95uaEvWYZsEdjTICc,5809
+imbi_plugin_github-2.9.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+imbi_plugin_github-2.9.2.dist-info/entry_points.txt,sha256=RavN_FYCeS97iauHgCG3tHFdVULbEMXmQfvgCgLeGkI,805
+imbi_plugin_github-2.9.2.dist-info/licenses/LICENSE,sha256=el9B20zOqEcv_mRrHgbdkVyxSC6I8np7am0D6mO2A9Y,1491
+imbi_plugin_github-2.9.2.dist-info/RECORD,,