imbi-plugin-github 2.9.1__tar.gz → 2.9.2__tar.gz

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/.pre-commit-config.yaml

@@ -21,6 +21,9 @@ repos:
     rev: v0.7.25
     hooks:
       - id: tombi-format
+        # uv owns uv.lock's formatting; tombi reflows it (2- vs 4-space),
+        # producing whole-file churn on every dependency change.
+        exclude: ^uv\.lock$
 
   - repo: local
     hooks:

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.9.1
+Version: 2.9.2
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,8 +13,9 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.9.1
+Requires-Dist: imbi-common[databases]==2.9.2
 Requires-Dist: pydantic>=2
+Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown
 
 # imbi-plugin-github
@@ -30,6 +31,7 @@ projects to the right backend.
 | Identity   | `github`, `github-enterprise-cloud`, `github-enterprise-server`      |
 | Deployment | `github-deployment`, `github-deployment-ec`, `github-deployment-es`  |
 | Lifecycle  | `github-lifecycle`, `github-lifecycle-ec`, `github-lifecycle-es`     |
+| Webhook    | `github-commit-sync`                                                  |
 
 ### Identity
 
@@ -63,6 +65,37 @@ org.
 Archiving requires admin scope on the repo; transferring additionally
 requires admin permission on the target organization.
 
+### Webhook (commit / tag sync)
+
+A single `github-commit-sync` webhook-action plugin exposes two actions
+the gateway dispatches on `push` deliveries:
+
+| Action         | Handler                          | Records into ClickHouse |
+| -------------- | -------------------------------- | ----------------------- |
+| `sync_commits` | `github-commit-sync#sync_commits`| `commits`               |
+| `sync_tags`    | `github-commit-sync#sync_tags`   | `tags`                  |
+
+`sync_commits` fetches the full set of commits in a push via the compare
+API (paginated, so it isn't capped by the 20-commit inline payload limit);
+`sync_tags` records the pushed tag and, with `reconcile_all`, the repo's
+full tag list. Branch/tag gating is the rule's CEL `filter_expression`
+(e.g. `ref == "refs/heads/main"`, `ref.startsWith("refs/tags/")`). The API
+flavor (github.com / GHEC / GHES) is resolved at runtime — explicit
+`api_base_url`, else a connected GitHub plugin on the same service, else
+the service endpoint, else the payload's `repository.url`.
+
+Unlike identity/deployment/lifecycle (which act as the OAuth user),
+commit-sync runs without an actor and authenticates with a **service**
+credential in one of two modes, resolved per call:
+
+- **PAT** — a static `access_token`.
+- **GitHub App** — `app_id` + `private_key`; the plugin signs an App JWT
+  and mints a short-lived **installation token** (cached process-wide
+  until shortly before it expires), so no static, expiring token is
+  stored. `installation_id` is optional — when unset it is discovered
+  from the pushed repository (`GET /repos/{owner}/{repo}/installation`).
+  The App needs **Contents: Read-only**.
+
 ## Manifest options (identity)
 
 | Option           | Required  | Description                                                                |
@@ -77,6 +110,18 @@ requires admin permission on the target organization.
 | `client_id`      | yes      |
 | `client_secret`  | yes      |
 
+## Credentials (commit-sync)
+
+Provide **either** the PAT field **or** the GitHub App fields (all
+individually optional; validated per call):
+
+| Field             | Mode | Description                                            |
+| ----------------- | ---- | ------------------------------------------------------ |
+| `access_token`    | PAT  | Static personal/service token.                         |
+| `app_id`          | App  | GitHub App identifier.                                 |
+| `private_key`     | App  | App private key — raw PEM or base64-encoded PEM.       |
+| `installation_id` | App  | Optional; discovered from the repo when unset.         |
+
 ## License
 
 BSD-3-Clause.

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/README.md

@@ -11,6 +11,7 @@ projects to the right backend.
 | Identity   | `github`, `github-enterprise-cloud`, `github-enterprise-server`      |
 | Deployment | `github-deployment`, `github-deployment-ec`, `github-deployment-es`  |
 | Lifecycle  | `github-lifecycle`, `github-lifecycle-ec`, `github-lifecycle-es`     |
+| Webhook    | `github-commit-sync`                                                  |
 
 ### Identity
 
@@ -44,6 +45,37 @@ org.
 Archiving requires admin scope on the repo; transferring additionally
 requires admin permission on the target organization.
 
+### Webhook (commit / tag sync)
+
+A single `github-commit-sync` webhook-action plugin exposes two actions
+the gateway dispatches on `push` deliveries:
+
+| Action         | Handler                          | Records into ClickHouse |
+| -------------- | -------------------------------- | ----------------------- |
+| `sync_commits` | `github-commit-sync#sync_commits`| `commits`               |
+| `sync_tags`    | `github-commit-sync#sync_tags`   | `tags`                  |
+
+`sync_commits` fetches the full set of commits in a push via the compare
+API (paginated, so it isn't capped by the 20-commit inline payload limit);
+`sync_tags` records the pushed tag and, with `reconcile_all`, the repo's
+full tag list. Branch/tag gating is the rule's CEL `filter_expression`
+(e.g. `ref == "refs/heads/main"`, `ref.startsWith("refs/tags/")`). The API
+flavor (github.com / GHEC / GHES) is resolved at runtime — explicit
+`api_base_url`, else a connected GitHub plugin on the same service, else
+the service endpoint, else the payload's `repository.url`.
+
+Unlike identity/deployment/lifecycle (which act as the OAuth user),
+commit-sync runs without an actor and authenticates with a **service**
+credential in one of two modes, resolved per call:
+
+- **PAT** — a static `access_token`.
+- **GitHub App** — `app_id` + `private_key`; the plugin signs an App JWT
+  and mints a short-lived **installation token** (cached process-wide
+  until shortly before it expires), so no static, expiring token is
+  stored. `installation_id` is optional — when unset it is discovered
+  from the pushed repository (`GET /repos/{owner}/{repo}/installation`).
+  The App needs **Contents: Read-only**.
+
 ## Manifest options (identity)
 
 | Option           | Required  | Description                                                                |
@@ -58,6 +90,18 @@ requires admin permission on the target organization.
 | `client_id`      | yes      |
 | `client_secret`  | yes      |
 
+## Credentials (commit-sync)
+
+Provide **either** the PAT field **or** the GitHub App fields (all
+individually optional; validated per call):
+
+| Field             | Mode | Description                                            |
+| ----------------- | ---- | ------------------------------------------------------ |
+| `access_token`    | PAT  | Static personal/service token.                         |
+| `app_id`          | App  | GitHub App identifier.                                 |
+| `private_key`     | App  | App private key — raw PEM or base64-encoded PEM.       |
+| `installation_id` | App  | Optional; discovered from the repo when unset.         |
+
 ## License
 
 BSD-3-Clause.

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-plugin-github"
-version = "2.9.1"
+version = "2.9.2"
 description = "GitHub identity plugin for Imbi (github.com / GHEC / GHES)"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,8 +16,9 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27",
-  "imbi-common[databases]==2.9.1",
+  "imbi-common[databases]==2.9.2",
   "pydantic>=2",
+  "pyjwt[crypto]>=2.8",
 ]
 
 [project.entry-points."imbi.plugins"]
@@ -36,7 +37,7 @@ github-commit-sync = "imbi_plugin_github.commits:GitHubCommitSyncPlugin"
 dev = [
   "basedpyright",
   "coverage[toml]",
-  "imbi-common[server,databases]==2.9.1",
+  "imbi-common[server,databases]==2.9.2",
   "pre-commit",
   "pytest",
   "pytest-asyncio",

imbi_plugin_github-2.9.2/src/imbi_plugin_github/_app_auth.py

@@ -0,0 +1,195 @@
+"""GitHub App installation-token minting for webhook actions.
+
+The commit-sync webhook plugin has no acting user, so when it is
+configured with GitHub App credentials (``app_id`` + ``private_key``) it
+mints a short-lived *installation* access token per call instead of
+carrying a static PAT.  Tokens are cached process-wide until shortly
+before they expire, so a busy org makes one token-exchange round-trip
+per hour per ``(app, installation, host)`` rather than one per webhook
+delivery.
+
+All three GitHub flavors work unchanged: the caller resolves the API
+base via :func:`imbi_plugin_github._hosts.host_to_api_base` and passes
+it in, so the JWT exchange hits ``api.github.com``,
+``api.<tenant>.ghe.com``, or ``<ghes>/api/v3`` as appropriate.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import datetime
+import logging
+import time
+import typing
+
+import httpx
+import jwt
+
+from imbi_plugin_github.deployment import (
+    _auth_headers,  # pyright: ignore[reportPrivateUsage]
+    _raise_on_401,  # pyright: ignore[reportPrivateUsage]
+)
+
+LOGGER = logging.getLogger(__name__)
+
+_HTTP_TIMEOUT_SECONDS = 10.0
+# GitHub rejects an App JWT whose ``exp`` is more than 10 minutes out;
+# sign for 9 to leave room for clock skew between us and GitHub.
+_JWT_TTL_SECONDS = 540
+# Re-mint an installation token this many seconds before it actually
+# expires so an in-flight request never races the expiry boundary.
+_TOKEN_REFRESH_MARGIN_SECONDS = 300.0
+# Installation tokens last an hour; assume ~55 minutes when GitHub omits
+# (or we can't parse) the ``expires_at`` field.
+_DEFAULT_TOKEN_TTL_SECONDS = 3300.0
+
+# Process-wide caches.  Token cache values are ``(token, deadline)`` where
+# ``deadline`` is a ``time.monotonic()`` instant; the installation cache
+# avoids re-discovering the installation id on every delivery.
+_TOKEN_CACHE: dict[tuple[str, str, str], tuple[str, float]] = {}
+_INSTALL_CACHE: dict[tuple[str, str, str, str], str] = {}
+
+
+def reset_cache() -> None:
+    """Clear the process-wide token / installation caches (tests)."""
+    _TOKEN_CACHE.clear()
+    _INSTALL_CACHE.clear()
+
+
+def _load_private_key(raw: str) -> str:
+    """Return a PEM private key from raw PEM or a base64-encoded PEM.
+
+    Operators may paste the key GitHub generated directly, or a
+    single-line base64 encoding of it (handy where the config UI lacks a
+    multi-line field).  Raises ``ValueError`` for anything else.
+    """
+    value = raw.strip()
+    if '-----BEGIN' in value:
+        return value
+    try:
+        decoded = base64.b64decode(value, validate=True).decode('utf-8')
+    except (binascii.Error, ValueError, UnicodeDecodeError) as exc:
+        raise ValueError(
+            'github-commit-sync private_key is neither a PEM nor a '
+            'base64-encoded PEM'
+        ) from exc
+    if '-----BEGIN' not in decoded:
+        raise ValueError(
+            'github-commit-sync private_key decoded but is not a PEM'
+        )
+    return decoded
+
+
+def _app_jwt(app_id: str, private_key: str) -> str:
+    now = int(time.time())
+    return jwt.encode(
+        {'iat': now - 60, 'exp': now + _JWT_TTL_SECONDS, 'iss': app_id},
+        _load_private_key(private_key),
+        algorithm='RS256',
+    )
+
+
+def _token_deadline(expires_at: object) -> float:
+    """Map GitHub's ISO ``expires_at`` to a monotonic cache deadline."""
+    now = time.monotonic()
+    if not isinstance(expires_at, str):
+        return now + _DEFAULT_TOKEN_TTL_SECONDS
+    try:
+        exp = datetime.datetime.fromisoformat(expires_at)
+    except ValueError:
+        return now + _DEFAULT_TOKEN_TTL_SECONDS
+    remaining = (exp - datetime.datetime.now(datetime.UTC)).total_seconds()
+    return now + max(0.0, remaining - _TOKEN_REFRESH_MARGIN_SECONDS)
+
+
+def _cached_token(key: tuple[str, str, str]) -> str | None:
+    entry = _TOKEN_CACHE.get(key)
+    if entry is not None and entry[1] > time.monotonic():
+        return entry[0]
+    return None
+
+
+async def _discover_installation_id(
+    client: httpx.AsyncClient, owner: str, repo: str
+) -> str:
+    resp = await client.get(f'/repos/{owner}/{repo}/installation')
+    resp.raise_for_status()
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    install_id = data.get('id')
+    if install_id is None:
+        raise ValueError(
+            f'no GitHub App installation found for {owner}/{repo}'
+        )
+    return str(install_id)
+
+
+async def _mint(
+    client: httpx.AsyncClient, installation_id: str
+) -> tuple[str, object]:
+    resp = await client.post(
+        f'/app/installations/{installation_id}/access_tokens'
+    )
+    resp.raise_for_status()
+    data = typing.cast('dict[str, typing.Any]', resp.json())
+    return str(data['token']), data.get('expires_at')
+
+
+async def installation_token(
+    *,
+    base: str,
+    app_id: str,
+    private_key: str,
+    installation_id: str | None,
+    owner: str,
+    repo: str,
+) -> str:
+    """Return a valid installation token, minting/caching as needed.
+
+    ``installation_id`` may be ``None``, in which case the installation
+    is discovered from the target repo (and cached).  The resulting
+    token is cached until shortly before it expires.
+    """
+    install = installation_id
+    if install is not None and (
+        cached := _cached_token((app_id, install, base))
+    ):
+        return cached
+    if install is None:
+        install = _INSTALL_CACHE.get((app_id, base, owner, repo))
+        if install is not None and (
+            cached := _cached_token((app_id, install, base))
+        ):
+            return cached
+
+    install_was_cached = install is not None and installation_id is None
+    app_token = _app_jwt(app_id, private_key)
+    async with httpx.AsyncClient(
+        base_url=base,
+        headers=_auth_headers(app_token),
+        timeout=_HTTP_TIMEOUT_SECONDS,
+        event_hooks={'response': [_raise_on_401]},
+    ) as client:
+        if install is None:
+            install = await _discover_installation_id(client, owner, repo)
+            _INSTALL_CACHE[(app_id, base, owner, repo)] = install
+            if cached := _cached_token((app_id, install, base)):
+                return cached
+        try:
+            token, expires_at = await _mint(client, install)
+        except httpx.HTTPStatusError as exc:
+            # A 404 (or 401, surfaced as PluginAuthenticationFailed by the
+            # response hook) against a *cached* installation id means the
+            # app was uninstalled/reinstalled or transferred. Evict the
+            # stale id and rediscover once before giving up.
+            if not install_was_cached or exc.response.status_code != 404:
+                raise
+            _INSTALL_CACHE.pop((app_id, base, owner, repo), None)
+            install = await _discover_installation_id(client, owner, repo)
+            _INSTALL_CACHE[(app_id, base, owner, repo)] = install
+            token, expires_at = await _mint(client, install)
+    _TOKEN_CACHE[(app_id, install, base)] = (
+        token,
+        _token_deadline(expires_at),
+    )
+    return token

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/src/imbi_plugin_github/commits.py

@@ -18,6 +18,12 @@ order:
 4. the push payload's ``repository.url`` (already the flavor-correct API
    URL) as a last resort.
 
+The same plugin also exposes :meth:`GitHubCommitSyncPlugin.sync_all_history`
+for an on-demand, host-invoked backfill: there is no push payload, so the
+GitHub host is read from ``ctx.service_plugins`` and ``(owner, repo)`` from
+the project links; it walks the full default-branch history and the
+complete tag list rather than a single push delta.
+
 Commit / tag rows are written to the shared ClickHouse ``commits`` /
 ``tags`` tables via :func:`imbi_common.clickhouse.insert`. Writes are
 best-effort: a storage failure is logged and swallowed so an analytics
@@ -47,11 +53,13 @@ from imbi_common.plugins.base import (
     WebhookActionPlugin,
 )
 
+from imbi_plugin_github import _app_auth
 from imbi_plugin_github._hosts import (
     host_to_api_base,
     normalize_host,
     require_ghec_tenant_host,
 )
+from imbi_plugin_github._repos import resolve_owner_repo
 from imbi_plugin_github.deployment import (
     _auth_headers,  # pyright: ignore[reportPrivateUsage]
     _next_page_url,  # pyright: ignore[reportPrivateUsage]
@@ -65,21 +73,51 @@ LOGGER = logging.getLogger(__name__)
 
 _HTTP_TIMEOUT_SECONDS = 10.0
 _ZERO_SHA = '0' * 40
+# This plugin's own slug; skipped when reading the GitHub host/flavor
+# from connected ``service_plugins`` so the commit-sync entry can't
+# masquerade as a github.com host on a GHEC/GHES service.
+_SELF_SLUG = 'github-commit-sync'
 # GitHub's compare endpoint caps ``commits[]`` at 250 per page and
 # paginates the rest; bound the walk so a pathological single push
 # (force-push of thousands of commits) can't pin us on one endpoint.
 # 250 * 20 = 5000 commits is far more than any realistic push.
 _MAX_COMPARE_PAGES = 20
-
-
-def _token(credentials: dict[str, str]) -> str:
+# On-demand full-history sync walks ``GET /commits`` from the default
+# branch head.  100 per page * 100 pages = 10k commits caps a one-shot
+# backfill so a very deep repo can't pin the worker indefinitely; the
+# walk logs a truncation warning when it hits the cap.
+_MAX_HISTORY_PAGES = 100
+
+
+async def _resolve_bearer(
+    credentials: dict[str, str], base: str, owner: str, repo: str
+) -> str:
+    """Resolve the Bearer token used for the repo's GitHub API calls.
+
+    Prefers an explicit PAT (``access_token``/``token``).  Otherwise
+    mints a short-lived GitHub App installation token from ``app_id`` +
+    ``private_key`` (with an optional ``installation_id`` that skips
+    per-repo installation discovery).  Tokens are cached process-wide by
+    :mod:`imbi_plugin_github._app_auth`.
+    """
     token = credentials.get('access_token') or credentials.get('token')
-    if not token:
-        raise ValueError(
-            'github-commit-sync requires a service token; expected '
-            "``credentials['access_token']``"
+    if token:
+        return token
+    app_id = credentials.get('app_id')
+    private_key = credentials.get('private_key')
+    if app_id and private_key:
+        return await _app_auth.installation_token(
+            base=base,
+            app_id=app_id,
+            private_key=private_key,
+            installation_id=credentials.get('installation_id') or None,
+            owner=owner,
+            repo=repo,
         )
-    return token
+    raise ValueError(
+        'github-commit-sync requires either an access_token (PAT) or '
+        'app_id + private_key (GitHub App) credentials'
+    )
 
 
 def _resolve(pointer: jsonpointer.JsonPointer, payload: object) -> object:
@@ -150,6 +188,11 @@ def _resolve_api_base(
     if explicit:
         return explicit.rstrip('/')
     for plugin in ctx.service_plugins:
+        # Skip our own entry: its slug starts with "github" but carries
+        # no host option, so _github_plugin_host would mis-resolve it to
+        # github.com on a GHEC/GHES service.
+        if plugin.slug == _SELF_SLUG:
+            continue
         host = _github_plugin_host(plugin)
         if host:
             return host_to_api_base(host)
@@ -324,6 +367,93 @@ async def _fetch_recent_commits(
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
 
 
+def _resolve_host_for_context(ctx: PluginContext) -> str | None:
+    """Resolve the GitHub web host for an on-demand sync (no payload).
+
+    Walks the connected GitHub plugins on ``ctx.service_plugins`` and
+    returns the first usable host (github.com, a GHEC tenant, or a GHES
+    appliance), skipping this plugin's own entry so a commit-sync row on a
+    GHEC/GHES service can't be read as github.com.  Unlike the webhook
+    path there is no push payload to fall back to, so the absence of a
+    connected GitHub plugin yields ``None``.
+    """
+    for plugin in ctx.service_plugins:
+        if plugin.slug == _SELF_SLUG:
+            continue
+        host = _github_plugin_host(plugin)
+        if host:
+            return host
+    return None
+
+
+async def _fetch_default_branch(client: httpx.AsyncClient) -> str:
+    """Return the repo's default branch name (``main`` when unknown)."""
+    # httpx normalises ``base_url`` with a trailing slash; GHEC's gateway
+    # 404s on ``/repos/<o>/<r>/`` so request the absolute URL with the
+    # trailing slash stripped, matching the deployment plugin.
+    url = str(client.base_url).rstrip('/')
+    resp = await client.get(url)
+    resp.raise_for_status()
+    meta = typing.cast('dict[str, typing.Any]', resp.json())
+    return str(meta.get('default_branch') or 'main')
+
+
+async def _fetch_all_commits(
+    client: httpx.AsyncClient, branch: str
+) -> list[dict[str, typing.Any]]:
+    """Walk every commit reachable from ``branch`` via Link pagination.
+
+    Capped at ``_MAX_HISTORY_PAGES`` (logged on truncation) so a very deep
+    repo can't pin a one-shot backfill indefinitely.
+    """
+    params: dict[str, str] = {'sha': branch, 'per_page': '100'}
+    out: list[dict[str, typing.Any]] = []
+    for page in range(1, _MAX_HISTORY_PAGES + 1):
+        resp = await client.get('/commits', params=params)
+        resp.raise_for_status()
+        out.extend(typing.cast('list[dict[str, typing.Any]]', resp.json()))
+        next_url = _next_page_url(resp.headers.get('link'))
+        if next_url is None:
+            return out
+        next_page = _query_param(next_url, 'page')
+        if next_page is None:
+            return out
+        params['page'] = next_page
+        if page == _MAX_HISTORY_PAGES:
+            LOGGER.warning(
+                'github-commit-sync truncated history at %d pages (%d '
+                'commits); older commits will not be recorded',
+                _MAX_HISTORY_PAGES,
+                len(out),
+            )
+    return out
+
+
+async def _insert_best_effort(
+    table: str, records: list[pydantic.BaseModel], project_id: str
+) -> int:
+    """Insert ``records`` into ``table``; return rows written (0 on fail).
+
+    ``imbi_common.clickhouse.insert`` rejects an empty list, so an empty
+    set short-circuits to 0.  A storage failure is logged and swallowed,
+    mirroring the webhook actions -- an analytics hiccup must not fail the
+    sync.
+    """
+    if not records:
+        return 0
+    try:
+        await clickhouse.insert(table, records)
+    except Exception:
+        LOGGER.exception(
+            'github-commit-sync: failed to record %d %s rows for project %s',
+            len(records),
+            table,
+            project_id,
+        )
+        return 0
+    return len(records)
+
+
 class SyncCommitsConfig(pydantic.BaseModel):
     """``WebhookRule.handler_config`` for ``sync_commits``."""
 
@@ -394,7 +524,8 @@ async def sync_commits(
     ref = _branch_short_name(ref_raw if isinstance(ref_raw, str) else '')
     before = _resolve(action_config.before_selector, payload)
     pushed_at = datetime.datetime.now(datetime.UTC)
-    async with _client(base, owner, repo, _token(credentials)) as client:
+    token = await _resolve_bearer(credentials, base, owner, repo)
+    async with _client(base, owner, repo, token) as client:
         if isinstance(before, str) and before and before != _ZERO_SHA:
             raw = await _fetch_compare_commits(client, before, after)
         else:
@@ -510,7 +641,8 @@ async def sync_tags(
     if resolved is None:
         return
     owner, repo, base = resolved
-    async with _client(base, owner, repo, _token(credentials)) as client:
+    token = await _resolve_bearer(credentials, base, owner, repo)
+    async with _client(base, owner, repo, token) as client:
         annotated = await _annotated_tag(client, after)
         records: list[pydantic.BaseModel] = [
             _tag_record(
@@ -566,9 +698,15 @@ sync_tags_descriptor = ActionDescriptor(
 class GitHubCommitSyncPlugin(WebhookActionPlugin):
     """Webhook-action plugin syncing GitHub commit / tag history.
 
-    Declares its own ``access_token`` service credential -- it is *not*
-    folded into the identity / deployment / lifecycle plugins, which run
-    as the acting user and carry no service token.
+    Carries its own service credential -- it is *not* folded into the
+    identity / deployment / lifecycle plugins, which run as the acting
+    user.  Two mutually exclusive auth modes are supported (resolved by
+    :func:`_resolve_bearer`):
+
+    * **PAT** -- a static ``access_token``.
+    * **GitHub App** -- ``app_id`` + ``private_key`` (raw or base64 PEM),
+      with an optional ``installation_id``; the plugin mints a
+      short-lived installation token per call and caches it.
     """
 
     manifest = PluginManifest(
@@ -582,12 +720,101 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         credentials=[
             CredentialField(
                 name='access_token',
-                label='GitHub Token',
-                description='Service token used to fetch commit history.',
-            )
+                label='GitHub Token (PAT)',
+                description=(
+                    'Static personal/service access token. Use this *or* '
+                    'the GitHub App fields below.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='app_id',
+                label='GitHub App ID',
+                description=(
+                    'GitHub App identifier; with a private key the plugin '
+                    'mints short-lived installation tokens.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='private_key',
+                label='GitHub App Private Key',
+                description=(
+                    'App private key, raw PEM or base64-encoded PEM.'
+                ),
+                required=False,
+            ),
+            CredentialField(
+                name='installation_id',
+                label='GitHub App Installation ID',
+                description=(
+                    'Optional. When unset, the installation is discovered '
+                    'from the pushed repository.'
+                ),
+                required=False,
+            ),
         ],
     )
 
     @classmethod
     def actions(cls) -> list[ActionDescriptor]:
         return [sync_commits_descriptor, sync_tags_descriptor]
+
+    async def sync_all_history(
+        self,
+        *,
+        ctx: PluginContext,
+        credentials: dict[str, str],
+    ) -> tuple[int, int]:
+        """Record the project's full default-branch history and all tags.
+
+        Host-invoked (no webhook payload): the host instantiates the
+        plugin, builds a :class:`PluginContext` carrying the project's
+        links and the connected ``service_plugins``, resolves this
+        plugin's service ``credentials``, and awaits this method.  The
+        GitHub host/flavor is read from ``service_plugins``, the
+        ``(owner, repo)`` from the project links, and the bearer token
+        from the same PAT-or-App resolution the webhook actions use.
+
+        Walks every commit reachable from the default branch head plus the
+        repo's complete (lightweight) tag list, maps them onto
+        ``CommitRecord`` / ``TagRecord``, and upserts into the ClickHouse
+        ``commits`` / ``tags`` tables.  ``ReplacingMergeTree`` dedupes
+        against rows the webhook already recorded, so re-running is safe.
+
+        Returns ``(commits_recorded, tags_recorded)``.  Raises
+        :class:`ValueError` only when the host or repository can't be
+        resolved; ClickHouse failures are swallowed (the count reflects
+        what was written).
+        """
+        host = _resolve_host_for_context(ctx)
+        if host is None:
+            raise ValueError(
+                'github-commit-sync could not resolve a GitHub host for an '
+                'on-demand sync: connect a GitHub plugin to the service'
+            )
+        base = host_to_api_base(host)
+        owner, repo = resolve_owner_repo(ctx, host, 'github-commit-sync')
+        pushed_at = datetime.datetime.now(datetime.UTC)
+        token = await _resolve_bearer(credentials, base, owner, repo)
+        async with _client(base, owner, repo, token) as client:
+            branch = await _fetch_default_branch(client)
+            raw_commits = await _fetch_all_commits(client, branch)
+            tags = await _reconcile_tags(client, ctx.project_id)
+        commit_records: list[pydantic.BaseModel] = [
+            _commit_record(
+                item,
+                project_id=ctx.project_id,
+                ref=branch,
+                pushed_at=pushed_at,
+            )
+            for item in raw_commits
+            if item.get('sha')
+        ]
+        commits_recorded = await _insert_best_effort(
+            'commits', commit_records, ctx.project_id
+        )
+        tags_recorded = await _insert_best_effort(
+            'tags', list(tags), ctx.project_id
+        )
+        return commits_recorded, tags_recorded

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/tests/test_commits.py

@@ -1,16 +1,19 @@
 """Tests for the GitHub commit / tag history sync webhook plugin."""
 
+import base64
 import typing
 import unittest
 from unittest import mock
 
 import httpx
 import respx
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from imbi_common.models import CommitRecord, TagRecord
 from imbi_common.plugins.base import PluginContext, ServicePlugin
 from imbi_common.plugins.errors import PluginAuthenticationFailed
 
-from imbi_plugin_github import commits
+from imbi_plugin_github import _app_auth, commits
 
 _ZERO = '0' * 40
 _CREDS = {'access_token': 'gho_test'}
@@ -18,6 +21,20 @@ _INSERT = 'imbi_plugin_github.commits.clickhouse.insert'
 _QUERY = 'imbi_plugin_github.commits.clickhouse.query'
 
 
+def _gen_pem() -> str:
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    ).decode()
+
+
+# Generated once for the module; signing only needs a valid RSA key.
+_APP_KEY_PEM = _gen_pem()
+_FAR_FUTURE = '2099-01-01T00:00:00Z'
+
+
 def _await_args(m: mock.AsyncMock) -> tuple[typing.Any, ...]:
     assert m.await_args is not None
     return m.await_args.args
@@ -152,6 +169,21 @@ class ApiBaseResolutionTestCase(unittest.TestCase):
         )
         self.assertEqual('https://ghe.example.com/api/v3', self._base(ctx=ctx))
 
+    def test_own_commit_sync_slug_skipped_on_ghec(self) -> None:
+        # A commit-sync entry's slug starts with "github" but has no host
+        # option; it must not resolve to github.com on a GHEC service —
+        # the real GHEC plugin behind it wins.
+        ctx = _ctx(
+            service_plugins=[
+                ServicePlugin(slug='github-commit-sync', options={}),
+                ServicePlugin(
+                    slug='github-deployment-ec',
+                    options={'host': 'tenant.ghe.com'},
+                ),
+            ]
+        )
+        self.assertEqual('https://api.tenant.ghe.com', self._base(ctx=ctx))
+
     def test_invalid_connected_plugin_host_falls_through(self) -> None:
         ctx = _ctx(
             service_plugins=[
@@ -361,9 +393,11 @@ class SyncCommitsTestCase(unittest.IsolatedAsyncioTestCase):
                     payload=_push(before=base, after=head),
                 )
 
-    async def test_missing_token_raises(self) -> None:
+    async def test_missing_credentials_raises(self) -> None:
         with self.assertRaises(ValueError):
-            commits._token({})
+            await commits._resolve_bearer(
+                {}, 'https://api.github.com', 'octo', 'demo'
+            )
 
 
 class SyncTagsTestCase(unittest.IsolatedAsyncioTestCase):
@@ -537,7 +571,12 @@ class ManifestTestCase(unittest.TestCase):
         self.assertEqual('github-commit-sync', manifest.slug)
         self.assertEqual('webhook', manifest.plugin_type)
         self.assertEqual(
-            ['access_token'], [c.name for c in manifest.credentials]
+            ['access_token', 'app_id', 'private_key', 'installation_id'],
+            [c.name for c in manifest.credentials],
+        )
+        self.assertTrue(
+            all(not c.required for c in manifest.credentials),
+            'all auth credentials are optional (PAT or App mode)',
         )
 
     def test_actions(self) -> None:
@@ -547,3 +586,399 @@ class ManifestTestCase(unittest.TestCase):
         # ImportString validation resolved the callables at construction.
         self.assertIs(descriptors[0].callable, commits.sync_commits)
         self.assertIs(descriptors[1].callable, commits.sync_tags)
+
+
+class PrivateKeyTestCase(unittest.TestCase):
+    def test_raw_pem_passthrough(self) -> None:
+        self.assertEqual(
+            _APP_KEY_PEM.strip(), _app_auth._load_private_key(_APP_KEY_PEM)
+        )
+
+    def test_base64_pem_decoded(self) -> None:
+        b64 = base64.b64encode(_APP_KEY_PEM.encode()).decode()
+        self.assertEqual(_APP_KEY_PEM, _app_auth._load_private_key(b64))
+
+    def test_garbage_raises(self) -> None:
+        with self.assertRaises(ValueError):
+            _app_auth._load_private_key('not a key at all !!!')
+
+    def test_base64_of_non_pem_raises(self) -> None:
+        b64 = base64.b64encode(b'just some bytes').decode()
+        with self.assertRaises(ValueError):
+            _app_auth._load_private_key(b64)
+
+
+class TokenDeadlineTestCase(unittest.TestCase):
+    def test_missing_expiry_uses_default_ttl(self) -> None:
+        # No expires_at -> a positive deadline (default ~55m) is returned.
+        self.assertGreater(_app_auth._token_deadline(None), 0.0)
+
+    def test_unparseable_expiry_uses_default_ttl(self) -> None:
+        self.assertGreater(_app_auth._token_deadline('not-a-date'), 0.0)
+
+
+class ResolveBearerTestCase(unittest.IsolatedAsyncioTestCase):
+    async def test_pat_preferred_over_app(self) -> None:
+        # A PAT short-circuits before any App minting / network call.
+        token = await commits._resolve_bearer(
+            {'access_token': 'gho_x', 'app_id': '971', 'private_key': 'k'},
+            'https://api.github.com',
+            'octo',
+            'demo',
+        )
+        self.assertEqual('gho_x', token)
+
+
+class AppAuthSyncTestCase(unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        _app_auth.reset_cache()
+
+    def tearDown(self) -> None:
+        _app_auth.reset_cache()
+
+    def _app_creds(
+        self, *, installation_id: str | None = '42'
+    ) -> dict[str, str]:
+        creds = {'app_id': '971', 'private_key': _APP_KEY_PEM}
+        if installation_id is not None:
+            creds['installation_id'] = installation_id
+        return creds
+
+    def _mock_token(self, token: str = 'ghs_minted') -> respx.Route:
+        return respx.post(
+            'https://api.github.com/app/installations/42/access_tokens'
+        ).mock(
+            return_value=httpx.Response(
+                201, json={'token': token, 'expires_at': _FAR_FUTURE}
+            )
+        )
+
+    def _mock_compare(self) -> respx.Route:
+        base, head = 'a' * 40, 'b' * 40
+        return respx.get(
+            f'https://api.github.com/repos/octo/demo/compare/{base}...{head}'
+        ).mock(
+            return_value=httpx.Response(
+                200, json={'commits': [_commit('c' * 40)]}
+            )
+        )
+
+    @respx.mock
+    async def test_app_mints_and_uses_token(self) -> None:
+        token_route = self._mock_token()
+        compare = self._mock_compare()
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=self._app_creds(),
+                external_identifier='',
+                action_config=commits.SyncCommitsConfig(),
+                payload=_push(),
+            )
+        insert.assert_awaited_once()
+        self.assertEqual(1, token_route.call_count)
+        self.assertEqual(
+            'Bearer ghs_minted',
+            compare.calls.last.request.headers['authorization'],
+        )
+
+    @respx.mock
+    async def test_explicit_installation_skips_discovery(self) -> None:
+        discovery = respx.get(
+            'https://api.github.com/repos/octo/demo/installation'
+        )
+        self._mock_token()
+        self._mock_compare()
+        with mock.patch(_INSERT, new=mock.AsyncMock()):
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=self._app_creds(installation_id='42'),
+                external_identifier='',
+                action_config=commits.SyncCommitsConfig(),
+                payload=_push(),
+            )
+        self.assertFalse(discovery.called)
+
+    @respx.mock
+    async def test_discovers_installation_when_absent(self) -> None:
+        discovery = respx.get(
+            'https://api.github.com/repos/octo/demo/installation'
+        ).mock(return_value=httpx.Response(200, json={'id': 42}))
+        token_route = self._mock_token()
+        self._mock_compare()
+        with mock.patch(_INSERT, new=mock.AsyncMock()):
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=self._app_creds(installation_id=None),
+                external_identifier='',
+                action_config=commits.SyncCommitsConfig(),
+                payload=_push(),
+            )
+        self.assertEqual(1, discovery.call_count)
+        self.assertEqual(1, token_route.call_count)
+
+    @respx.mock
+    async def test_token_cached_across_calls(self) -> None:
+        token_route = self._mock_token()
+        self._mock_compare()
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            for _ in range(2):
+                await commits.sync_commits(
+                    ctx=_ctx(),
+                    credentials=self._app_creds(),
+                    external_identifier='',
+                    action_config=commits.SyncCommitsConfig(),
+                    payload=_push(),
+                )
+        self.assertEqual(2, insert.await_count)
+        # Minted once, reused on the second delivery.
+        self.assertEqual(1, token_route.call_count)
+
+    @respx.mock
+    async def test_discovered_installation_and_token_cached(self) -> None:
+        discovery = respx.get(
+            'https://api.github.com/repos/octo/demo/installation'
+        ).mock(return_value=httpx.Response(200, json={'id': 42}))
+        token_route = self._mock_token()
+        self._mock_compare()
+        with mock.patch(_INSERT, new=mock.AsyncMock()):
+            for _ in range(2):
+                await commits.sync_commits(
+                    ctx=_ctx(),
+                    credentials=self._app_creds(installation_id=None),
+                    external_identifier='',
+                    action_config=commits.SyncCommitsConfig(),
+                    payload=_push(),
+                )
+        # Discovery and minting both happen once, then served from cache.
+        self.assertEqual(1, discovery.call_count)
+        self.assertEqual(1, token_route.call_count)
+
+    @respx.mock
+    async def test_stale_cached_install_rediscovered_on_404(self) -> None:
+        # Seed the install cache with a now-stale id, then make minting
+        # against it 404 (uninstall/reinstall). The token call should
+        # evict the stale id, rediscover, and mint against the new one.
+        _app_auth._INSTALL_CACHE[
+            ('971', 'https://api.github.com', 'octo', 'demo')
+        ] = '7'
+        stale = respx.post(
+            'https://api.github.com/app/installations/7/access_tokens'
+        ).mock(return_value=httpx.Response(404, json={'message': 'gone'}))
+        discovery = respx.get(
+            'https://api.github.com/repos/octo/demo/installation'
+        ).mock(return_value=httpx.Response(200, json={'id': 42}))
+        fresh = self._mock_token()
+        token = await _app_auth.installation_token(
+            base='https://api.github.com',
+            app_id='971',
+            private_key=_APP_KEY_PEM,
+            installation_id=None,
+            owner='octo',
+            repo='demo',
+        )
+        self.assertEqual('ghs_minted', token)
+        self.assertEqual(1, stale.call_count)
+        self.assertEqual(1, discovery.call_count)
+        self.assertEqual(1, fresh.call_count)
+        self.assertEqual(
+            '42',
+            _app_auth._INSTALL_CACHE[
+                ('971', 'https://api.github.com', 'octo', 'demo')
+            ],
+        )
+
+    @respx.mock
+    async def test_base64_private_key_accepted(self) -> None:
+        self._mock_token()
+        self._mock_compare()
+        creds = self._app_creds()
+        creds['private_key'] = base64.b64encode(_APP_KEY_PEM.encode()).decode()
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            await commits.sync_commits(
+                ctx=_ctx(),
+                credentials=creds,
+                external_identifier='',
+                action_config=commits.SyncCommitsConfig(),
+                payload=_push(),
+            )
+        insert.assert_awaited_once()
+
+
+class HostForContextTestCase(unittest.TestCase):
+    def test_resolves_from_connected_github_plugin(self) -> None:
+        ctx = _ctx(service_plugins=[ServicePlugin(slug='github', options={})])
+        self.assertEqual('github.com', commits._resolve_host_for_context(ctx))
+
+    def test_skips_own_slug_for_ghec(self) -> None:
+        # A commit-sync entry must not be read as github.com on a GHEC
+        # service; the real GHEC plugin behind it wins.
+        ctx = _ctx(
+            service_plugins=[
+                ServicePlugin(slug='github-commit-sync', options={}),
+                ServicePlugin(
+                    slug='github-deployment-ec',
+                    options={'host': 'tenant.ghe.com'},
+                ),
+            ]
+        )
+        self.assertEqual(
+            'tenant.ghe.com', commits._resolve_host_for_context(ctx)
+        )
+
+    def test_no_github_plugin_returns_none(self) -> None:
+        ctx = _ctx(service_plugins=[ServicePlugin(slug='sonarqube')])
+        self.assertIsNone(commits._resolve_host_for_context(ctx))
+
+
+class SyncAllHistoryTestCase(unittest.IsolatedAsyncioTestCase):
+    _REPO = 'https://api.github.com/repos/octo/demo'
+
+    def _ctx(self) -> PluginContext:
+        return _ctx(service_plugins=[ServicePlugin(slug='github', options={})])
+
+    def _mock_default_branch(self, branch: str = 'main') -> respx.Route:
+        return respx.get(self._REPO).mock(
+            return_value=httpx.Response(200, json={'default_branch': branch})
+        )
+
+    @respx.mock
+    async def test_records_full_history_and_tags(self) -> None:
+        self._mock_default_branch()
+        commit_route = respx.get(f'{self._REPO}/commits').mock(
+            return_value=httpx.Response(
+                200, json=[_commit('c' * 40), _commit('d' * 40)]
+            )
+        )
+        respx.get(f'{self._REPO}/tags').mock(
+            return_value=httpx.Response(
+                200,
+                json=[
+                    {'name': 'v1.0.0', 'commit': {'sha': 'z' * 40}},
+                    {'name': 'v1.1.0', 'commit': {'sha': 'y' * 40}},
+                ],
+            )
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            result = await commits.GitHubCommitSyncPlugin().sync_all_history(
+                ctx=self._ctx(), credentials=_CREDS
+            )
+        self.assertEqual((2, 2), result)
+        self.assertEqual(
+            'main', commit_route.calls.last.request.url.params['sha']
+        )
+        self.assertEqual(2, insert.await_count)
+        tables = {call.args[0] for call in insert.await_args_list}
+        self.assertEqual({'commits', 'tags'}, tables)
+        commit_call = next(
+            c for c in insert.await_args_list if c.args[0] == 'commits'
+        )
+        records = commit_call.args[1]
+        self.assertIsInstance(records[0], CommitRecord)
+        self.assertEqual('main', records[0].ref)
+
+    @respx.mock
+    async def test_paginates_commits(self) -> None:
+        self._mock_default_branch()
+        url = f'{self._REPO}/commits'
+        respx.get(url).mock(
+            side_effect=[
+                httpx.Response(
+                    200,
+                    json=[_commit('1' * 40)],
+                    headers={'link': f'<{url}?page=2>; rel="next"'},
+                ),
+                httpx.Response(200, json=[_commit('2' * 40)]),
+            ]
+        )
+        respx.get(f'{self._REPO}/tags').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        with mock.patch(_INSERT, new=mock.AsyncMock()) as insert:
+            (
+                commits_recorded,
+                tags_recorded,
+            ) = await commits.GitHubCommitSyncPlugin().sync_all_history(
+                ctx=self._ctx(), credentials=_CREDS
+            )
+        self.assertEqual(2, commits_recorded)
+        self.assertEqual(0, tags_recorded)
+        # Only the commits insert ran; the empty tag list short-circuits.
+        insert.assert_awaited_once()
+
+    @respx.mock
+    async def test_history_truncation_logs(self) -> None:
+        self._mock_default_branch()
+        url = f'{self._REPO}/commits'
+        respx.get(url).mock(
+            return_value=httpx.Response(
+                200,
+                json=[_commit('1' * 40)],
+                headers={'link': f'<{url}?page=2>; rel="next"'},
+            )
+        )
+        respx.get(f'{self._REPO}/tags').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        with mock.patch.object(commits, '_MAX_HISTORY_PAGES', 1):
+            with mock.patch(_INSERT, new=mock.AsyncMock()):
+                with self.assertLogs(commits.LOGGER, level='WARNING') as cm:
+                    await commits.GitHubCommitSyncPlugin().sync_all_history(
+                        ctx=self._ctx(), credentials=_CREDS
+                    )
+        self.assertTrue(any('truncated history' in x for x in cm.output))
+
+    @respx.mock
+    async def test_no_github_host_raises(self) -> None:
+        with self.assertRaises(ValueError):
+            await commits.GitHubCommitSyncPlugin().sync_all_history(
+                ctx=_ctx(), credentials=_CREDS
+            )
+
+    @respx.mock
+    async def test_clickhouse_failure_swallowed(self) -> None:
+        self._mock_default_branch()
+        respx.get(f'{self._REPO}/commits').mock(
+            return_value=httpx.Response(200, json=[_commit('c' * 40)])
+        )
+        respx.get(f'{self._REPO}/tags').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        failing = mock.AsyncMock(side_effect=RuntimeError('clickhouse down'))
+        with mock.patch(_INSERT, new=failing):
+            with self.assertLogs(commits.LOGGER, level='ERROR'):
+                result = await (
+                    commits.GitHubCommitSyncPlugin().sync_all_history(
+                        ctx=self._ctx(), credentials=_CREDS
+                    )
+                )
+        self.assertEqual((0, 0), result)
+
+    @respx.mock
+    async def test_app_auth_mints_token(self) -> None:
+        _app_auth.reset_cache()
+        self.addCleanup(_app_auth.reset_cache)
+        token_route = respx.post(
+            'https://api.github.com/app/installations/42/access_tokens'
+        ).mock(
+            return_value=httpx.Response(
+                201, json={'token': 'ghs_minted', 'expires_at': _FAR_FUTURE}
+            )
+        )
+        self._mock_default_branch()
+        respx.get(f'{self._REPO}/commits').mock(
+            return_value=httpx.Response(200, json=[_commit('c' * 40)])
+        )
+        respx.get(f'{self._REPO}/tags').mock(
+            return_value=httpx.Response(200, json=[])
+        )
+        creds = {
+            'app_id': '971',
+            'private_key': _APP_KEY_PEM,
+            'installation_id': '42',
+        }
+        with mock.patch(_INSERT, new=mock.AsyncMock()):
+            await commits.GitHubCommitSyncPlugin().sync_all_history(
+                ctx=self._ctx(), credentials=creds
+            )
+        self.assertEqual(1, token_route.call_count)

{imbi_plugin_github-2.9.1 → imbi_plugin_github-2.9.2}/uv.lock

@@ -667,7 +667,7 @@ wheels = [
 
 [[package]]
 name = "imbi-common"
-version = "2.9.1"
+version = "2.9.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
   { name = "cryptography" },
@@ -683,9 +683,9 @@ dependencies = [
   { name = "python-slugify" },
   { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9a/7a/0dc31034aa22aaa92929eeaf317c6b552e659b5e1557d1bd605edcc6f1cd/imbi_common-2.9.1.tar.gz", hash = "sha256:0808fbe949b3e1c347dcfb7c879c0cc547143e97f85c35c623dfd9971de041a9", size = 336897, upload-time = "2026-06-04T01:38:52.101Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/aa/0d/39325e67d4fa8de59ee2962339cc5c7dcd0891298c034b23950b003d120e/imbi_common-2.9.2.tar.gz", hash = "sha256:236b0a7baee0125c4af9449c1a99326d49813466e7b0732b4ebbcb618a7f8cf6", size = 338283, upload-time = "2026-06-04T17:42:41.652Z" }
 wheels = [
-  { url = "https://files.pythonhosted.org/packages/14/d7/496d7edcbfc0f6a6551c16abd4e368bb756ee444711c350e09d5b736542b/imbi_common-2.9.1-py3-none-any.whl", hash = "sha256:4b445b30461c7d15e3d1635720f32d95f49f38369b5b1939bff5e9c89545bc6c", size = 107627, upload-time = "2026-06-04T01:38:50.624Z" },
+  { url = "https://files.pythonhosted.org/packages/ec/86/88ff71441a35836c791fbd7565e1a2359bddf60b91376eb132fd0d2d3dce/imbi_common-2.9.2-py3-none-any.whl", hash = "sha256:f72db0695a0e7406e99e2a7c4497883f76f3025af82e904e3bfd2d2c013d52de", size = 108246, upload-time = "2026-06-04T17:42:40.216Z" },
 ]
 
 [package.optional-dependencies]
@@ -703,12 +703,13 @@ server = [
 
 [[package]]
 name = "imbi-plugin-github"
-version = "2.9.1"
+version = "2.9.2"
 source = { editable = "." }
 dependencies = [
   { name = "httpx" },
   { name = "imbi-common", extra = ["databases"] },
   { name = "pydantic" },
+  { name = "pyjwt", extra = ["crypto"] },
 ]
 
 [package.dev-dependencies]
@@ -731,15 +732,16 @@ dist = [
 [package.metadata]
 requires-dist = [
   { name = "httpx", specifier = ">=0.27" },
-  { name = "imbi-common", extras = ["databases"], specifier = "==2.9.1" },
+  { name = "imbi-common", extras = ["databases"], specifier = "==2.9.2" },
   { name = "pydantic", specifier = ">=2" },
+  { name = "pyjwt", extras = ["crypto"], specifier = ">=2.8" },
 ]
 
 [package.metadata.requires-dev]
 dev = [
   { name = "basedpyright" },
   { name = "coverage", extras = ["toml"] },
-  { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.9.1" },
+  { name = "imbi-common", extras = ["server", "databases"], specifier = "==2.9.2" },
   { name = "pre-commit" },
   { name = "pytest" },
   { name = "pytest-asyncio" },
@@ -1430,6 +1432,11 @@ wheels = [
   { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
 ]
 
+[package.optional-dependencies]
+crypto = [
+  { name = "cryptography" },
+]
+
 [[package]]
 name = "pyproject-hooks"
 version = "1.2.0"