imbi-plugin-github 2.9.2__py3-none-any.whl → 2.10.0__py3-none-any.whl

imbi_plugin_github/commits.py

@@ -33,8 +33,12 @@ recording behaves.
 
 from __future__ import annotations
 
+import asyncio
+import collections
+import collections.abc
 import datetime
 import logging
+import time
 import typing
 import urllib.parse
 
@@ -88,6 +92,136 @@ _MAX_COMPARE_PAGES = 20
 # walk logs a truncation warning when it hits the cap.
 _MAX_HISTORY_PAGES = 100
 
+# Per-context ceilings on how long a *single* rate-limit pause may block
+# before the sync gives up best-effort (logged).  The webhook actions
+# (``sync_commits`` / ``sync_tags``) run inside the gateway's request
+# path, so they pause only briefly and bail when GitHub's reset is
+# further out -- a later push re-syncs the gap (``ReplacingMergeTree``
+# dedupes).  The on-demand backfill (``sync_all_history``) runs in a
+# background worker and can wait out a full primary-limit reset.
+_WEBHOOK_MAX_WAIT_SECONDS = 60.0
+_BACKFILL_MAX_WAIT_SECONDS = 900.0
+# GitHub's documented floor to wait when a secondary (abuse) rate-limit
+# response carries neither ``retry-after`` nor an exhausted
+# ``x-ratelimit-*`` to time the resume from.
+_SECONDARY_LIMIT_WAIT_SECONDS = 60.0
+# Small cushion added to a primary-limit reset wait so minor clock skew
+# between us and GitHub can't wake us a hair early into a re-throttle.
+_RESET_BUFFER_SECONDS = 1.0
+# Pathological-loop guard: how many times one request may be paused and
+# retried before giving up.  A primary reset / ``retry-after`` normally
+# clears the limit on the first retry, so this only bounds a misbehaving
+# endpoint.
+_MAX_THROTTLE_RETRIES = 3
+
+
+def _header_int(response: httpx.Response, name: str) -> int | None:
+    """Parse an integer response header, ``None`` when absent/malformed."""
+    raw = response.headers.get(name)
+    if raw is None:
+        return None
+    try:
+        return int(raw)
+    except ValueError:
+        return None
+
+
+def _throttle_wait(response: httpx.Response) -> float | None:
+    """Seconds to pause for GitHub's rate-limit headers, else ``None``.
+
+    Detects both throttle styles GitHub documents and reads the resume
+    time straight from the response:
+
+    * **secondary limit** -- a ``retry-after`` header (any status): honor
+      it verbatim;
+    * **primary limit** -- ``x-ratelimit-remaining: 0`` with an
+      ``x-ratelimit-reset`` epoch: wait until the reset (plus a small
+      clock-skew cushion);
+    * a 403/429 that exhausted the quota but gives no reset -> the
+      conservative ``_SECONDARY_LIMIT_WAIT_SECONDS`` floor.
+
+    Returns ``None`` for anything that is *not* a throttle signal --
+    including a non-rate-limit 403 (e.g. insufficient scope), which must
+    fall through to the caller's normal error handling rather than be
+    mistaken for a pause.  A successful response that merely depleted the
+    quota (``remaining == 0`` on a 2xx) also yields a wait, so the caller
+    can pause pre-emptively before the next request.
+    """
+    retry_after = response.headers.get('retry-after')
+    if retry_after is not None:
+        try:
+            return max(0.0, float(retry_after))
+        except ValueError:
+            return _SECONDARY_LIMIT_WAIT_SECONDS
+    if _header_int(response, 'x-ratelimit-remaining') == 0:
+        reset = _header_int(response, 'x-ratelimit-reset')
+        if reset is not None:
+            return max(0.0, reset - time.time()) + _RESET_BUFFER_SECONDS
+        if response.status_code in (403, 429):
+            return _SECONDARY_LIMIT_WAIT_SECONDS
+    return None
+
+
+async def _request(
+    client: httpx.AsyncClient,
+    method: str,
+    url: str,
+    *,
+    max_wait: float,
+    **kwargs: typing.Any,
+) -> httpx.Response:
+    """Issue a request, pausing and resuming on GitHub rate limits.
+
+    On a throttled response (403/429 carrying a rate-limit signal) sleeps
+    for the interval GitHub states in its headers, then retries -- up to
+    ``_MAX_THROTTLE_RETRIES`` times and never longer than *max_wait* on a
+    single pause.  When the stated wait exceeds *max_wait* (or the retries
+    are exhausted) the throttled response is handed back unchanged so the
+    caller's ``raise_for_status`` surfaces it and the sync bails
+    best-effort.  After a *successful* response that exhausted the
+    remaining quota, pauses pre-emptively (subject to the same cap) so the
+    next call doesn't spend a round-trip on a guaranteed rejection.
+    """
+    attempts = 0
+    while True:
+        response = await client.request(method, url, **kwargs)
+        wait = _throttle_wait(response)
+        if wait is None:
+            return response
+        if response.status_code not in (403, 429):
+            # Pre-emptive: the request succeeded but drained the quota;
+            # pause (bounded) so the next call isn't a guaranteed 403,
+            # then hand back the good response.
+            if wait <= max_wait:
+                LOGGER.info(
+                    'github-commit-sync quota exhausted on %s; pausing '
+                    '%.0fs before continuing',
+                    url,
+                    wait,
+                )
+                await asyncio.sleep(wait)
+            return response
+        if wait > max_wait or attempts >= _MAX_THROTTLE_RETRIES:
+            LOGGER.warning(
+                'github-commit-sync rate-limited on %s (wait %.0fs, cap '
+                '%.0fs, attempt %d); bailing best-effort',
+                url,
+                wait,
+                max_wait,
+                attempts + 1,
+            )
+            return response
+        attempts += 1
+        LOGGER.warning(
+            'github-commit-sync rate-limited on %s; pausing %.0fs then '
+            'retrying (attempt %d/%d)',
+            url,
+            wait,
+            attempts,
+            _MAX_THROTTLE_RETRIES,
+        )
+        await asyncio.sleep(wait)
+
 
 async def _resolve_bearer(
     credentials: dict[str, str], base: str, owner: str, repo: str
@@ -120,11 +254,11 @@ async def _resolve_bearer(
     )
 
 
-def _resolve(pointer: jsonpointer.JsonPointer, payload: object) -> object:
-    """Resolve a JSON Pointer against the payload, ``None`` if absent."""
+def _resolve(pointer: jsonpointer.JsonPointer, event: object) -> object:
+    """Resolve a JSON Pointer against the event, ``None`` if absent."""
     return typing.cast(
         'object',
-        pointer.resolve(payload, None),  # pyright: ignore[reportUnknownMemberType]
+        pointer.resolve(event, None),  # pyright: ignore[reportUnknownMemberType]
     )
 
 
@@ -182,7 +316,7 @@ def _resolve_api_base(
     ctx: PluginContext,
     explicit: str | None,
     repo_url_pointer: jsonpointer.JsonPointer,
-    payload: object,
+    event: object,
 ) -> str | None:
     """Pick the GitHub API base for this call (see module docstring)."""
     if explicit:
@@ -199,11 +333,11 @@ def _resolve_api_base(
     endpoint = ctx.assignment_options.get('service_endpoint')
     if isinstance(endpoint, str) and endpoint:
         return endpoint.rstrip('/')
-    base = _api_base_from_repo_url(_resolve(repo_url_pointer, payload))
+    base = _api_base_from_repo_url(_resolve(repo_url_pointer, event))
     if base:
         LOGGER.info(
-            'github-commit-sync falling back to payload repository.url for '
-            'the API base; no api_base_url, connected GitHub plugin, or '
+            "github-commit-sync falling back to the event's repository.url "
+            'for the API base; no api_base_url, connected GitHub plugin, or '
             'service_endpoint was available'
         )
         return base
@@ -211,9 +345,9 @@ def _resolve_api_base(
 
 
 def _owner_repo(
-    selector: jsonpointer.JsonPointer, payload: object
+    selector: jsonpointer.JsonPointer, event: object
 ) -> tuple[str, str] | None:
-    full_name = _resolve(selector, payload)
+    full_name = _resolve(selector, event)
     if not isinstance(full_name, str) or '/' not in full_name:
         return None
     owner, _, repo = full_name.partition('/')
@@ -225,14 +359,14 @@ def _owner_repo(
 def _resolve_repo_and_base(
     ctx: PluginContext,
     action_config: SyncCommitsConfig | SyncTagsConfig,
-    payload: object,
+    event: object,
 ) -> tuple[str, str, str] | None:
     """Resolve ``(owner, repo, api_base)`` for an action.
 
     Returns ``None`` (after logging) when the owner/repo or API base
     can't be determined, so both action callables share one short-circuit.
     """
-    owner_repo = _owner_repo(action_config.repository_selector, payload)
+    owner_repo = _owner_repo(action_config.repository_selector, event)
     if owner_repo is None:
         LOGGER.warning('github-commit-sync: no owner/repo in push payload')
         return None
@@ -240,7 +374,7 @@ def _resolve_repo_and_base(
         ctx,
         action_config.api_base_url,
         action_config.repo_api_url_selector,
-        payload,
+        event,
     )
     if base is None:
         LOGGER.warning(
@@ -262,12 +396,103 @@ def _client(base: str, owner: str, repo: str, token: str) -> httpx.AsyncClient:
     )
 
 
+ResolveUser = collections.abc.Callable[
+    [str], collections.abc.Awaitable[str | None]
+]
+
+# Process-wide, bounded LRU cache of resolved commit-author identities,
+# keyed by ``(api_base, subject)``.  The subject is GitHub's numeric user
+# id, which is only unique *per host* (github.com id 42 != a GHES id 42),
+# so the resolved API base scopes the key.  Only *successful* resolutions
+# are cached: within a single sync :func:`_resolve_author_users` already
+# de-dupes subjects, and leaving misses uncached means a contributor who
+# links their Imbi identity later is picked up on the next sync instead
+# of being stuck unresolved for the process's lifetime.  An
+# ``OrderedDict`` gives LRU eviction once the cache exceeds
+# ``_USER_CACHE_MAX`` entries.
+_USER_CACHE: collections.OrderedDict[tuple[str, str], str] = (
+    collections.OrderedDict()
+)
+_USER_CACHE_MAX = 8192
+
+
+async def _resolve_user(
+    resolver: ResolveUser, base: str, subject: str
+) -> str | None:
+    """Resolve a GitHub user id to an Imbi email, LRU-cached per host.
+
+    ``subject`` is the GitHub numeric user id (the identity-plugin
+    subject).  Only successful resolutions are memoized under
+    ``(base, subject)``; a miss is returned but not cached, so a
+    contributor who links their Imbi identity later resolves on a
+    subsequent sync rather than being memoized as unresolved for the
+    process's lifetime.
+    """
+    key = (base, subject)
+    if key in _USER_CACHE:
+        _USER_CACHE.move_to_end(key)
+        return _USER_CACHE[key]
+    email = await resolver(subject)
+    if email is None:
+        return None
+    _USER_CACHE[key] = email
+    _USER_CACHE.move_to_end(key)
+    if len(_USER_CACHE) > _USER_CACHE_MAX:
+        _USER_CACHE.popitem(last=False)
+    return email
+
+
+async def _resolve_author_users(
+    raw: list[dict[str, typing.Any]],
+    resolver: ResolveUser | None,
+    base: str,
+) -> dict[str, str]:
+    """Map each commit's GitHub author id to a resolved Imbi email.
+
+    Returns an empty map when the host wired no resolver.  Distinct
+    author ids are resolved once each (LRU-cached across syncs); misses
+    are dropped, so the map carries only positive matches and
+    :func:`_author_user` falls back to ``''`` for everyone else.
+    """
+    if resolver is None:
+        return {}
+    subjects: set[str] = set()
+    for item in raw:
+        gh_author: dict[str, typing.Any] = item.get('author') or {}
+        gid = gh_author.get('id')
+        if gid is not None:
+            subjects.add(str(gid))
+    out: dict[str, str] = {}
+    for subject in subjects:
+        try:
+            email = await _resolve_user(resolver, base, subject)
+        except Exception as exc:  # noqa: BLE001 - attribution is best-effort
+            LOGGER.warning(
+                'github-commit-sync: failed to resolve author %s; '
+                'leaving unattributed: %s',
+                subject,
+                exc,
+            )
+            continue
+        if email:
+            out[subject] = email
+    return out
+
+
+def _author_user(item: dict[str, typing.Any], user_map: dict[str, str]) -> str:
+    """Resolved Imbi email for a commit's author, ``''`` when unmatched."""
+    gh_author: dict[str, typing.Any] = item.get('author') or {}
+    gid = gh_author.get('id')
+    return user_map.get(str(gid), '') if gid is not None else ''
+
+
 def _commit_record(
     item: dict[str, typing.Any],
     *,
     project_id: str,
     ref: str,
     pushed_at: datetime.datetime,
+    author_user: str = '',
 ) -> CommitRecord:
     """Map a GitHub commit object onto a :class:`CommitRecord`.
 
@@ -292,6 +517,7 @@ def _commit_record(
         author_name=str(author_meta.get('name') or ''),
         author_email=str(author_meta.get('email') or ''),
         author_login=str(gh_author.get('login') or ''),
+        author_user=author_user,
         committer_name=str(committer_meta.get('name') or ''),
         authored_at=authored_at or pushed_at,
         committed_at=_parse_iso(committer_meta.get('date')),
@@ -301,7 +527,7 @@ def _commit_record(
 
 
 async def _fetch_compare_commits(
-    client: httpx.AsyncClient, base: str, head: str
+    client: httpx.AsyncClient, base: str, head: str, *, max_wait: float
 ) -> list[dict[str, typing.Any]]:
     """``GET /compare/{base}...{head}`` following the Link pagination."""
     quoted = urllib.parse.quote(f'{base}...{head}', safe='.')
@@ -309,7 +535,9 @@ async def _fetch_compare_commits(
     params: dict[str, str] = {'per_page': '250'}
     commits: list[dict[str, typing.Any]] = []
     for page in range(1, _MAX_COMPARE_PAGES + 1):
-        resp = await client.get(path, params=params)
+        resp = await _request(
+            client, 'GET', path, params=params, max_wait=max_wait
+        )
         resp.raise_for_status()
         payload = typing.cast('dict[str, typing.Any]', resp.json())
         commits.extend(payload.get('commits') or [])
@@ -356,12 +584,15 @@ async def _last_known_sha(project_id: str) -> str | None:
 
 
 async def _fetch_recent_commits(
-    client: httpx.AsyncClient, head: str, limit: int
+    client: httpx.AsyncClient, head: str, limit: int, *, max_wait: float
 ) -> list[dict[str, typing.Any]]:
     """Bounded ``GET /commits?sha={head}`` fallback for new branches."""
-    resp = await client.get(
+    resp = await _request(
+        client,
+        'GET',
         '/commits',
         params={'sha': head, 'per_page': str(max(1, min(limit, 100)))},
+        max_wait=max_wait,
     )
     resp.raise_for_status()
     return typing.cast('list[dict[str, typing.Any]]', resp.json())
@@ -386,20 +617,22 @@ def _resolve_host_for_context(ctx: PluginContext) -> str | None:
     return None
 
 
-async def _fetch_default_branch(client: httpx.AsyncClient) -> str:
+async def _fetch_default_branch(
+    client: httpx.AsyncClient, *, max_wait: float
+) -> str:
     """Return the repo's default branch name (``main`` when unknown)."""
     # httpx normalises ``base_url`` with a trailing slash; GHEC's gateway
     # 404s on ``/repos/<o>/<r>/`` so request the absolute URL with the
     # trailing slash stripped, matching the deployment plugin.
     url = str(client.base_url).rstrip('/')
-    resp = await client.get(url)
+    resp = await _request(client, 'GET', url, max_wait=max_wait)
     resp.raise_for_status()
     meta = typing.cast('dict[str, typing.Any]', resp.json())
     return str(meta.get('default_branch') or 'main')
 
 
 async def _fetch_all_commits(
-    client: httpx.AsyncClient, branch: str
+    client: httpx.AsyncClient, branch: str, *, max_wait: float
 ) -> list[dict[str, typing.Any]]:
     """Walk every commit reachable from ``branch`` via Link pagination.
 
@@ -409,7 +642,9 @@ async def _fetch_all_commits(
     params: dict[str, str] = {'sha': branch, 'per_page': '100'}
     out: list[dict[str, typing.Any]] = []
     for page in range(1, _MAX_HISTORY_PAGES + 1):
-        resp = await client.get('/commits', params=params)
+        resp = await _request(
+            client, 'GET', '/commits', params=params, max_wait=max_wait
+        )
         resp.raise_for_status()
         out.extend(typing.cast('list[dict[str, typing.Any]]', resp.json()))
         next_url = _next_page_url(resp.headers.get('link'))
@@ -455,46 +690,58 @@ async def _insert_best_effort(
 
 
 class SyncCommitsConfig(pydantic.BaseModel):
-    """``WebhookRule.handler_config`` for ``sync_commits``."""
+    """``WebhookRule.handler_config`` for ``sync_commits``.
+
+    Selectors resolve against the event context, so the push body lives
+    under ``/payload`` (e.g. ``/payload/after``).
+    """
 
     before_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/before')
+        default_factory=lambda: jsonpointer.JsonPointer('/payload/before')
     )
     after_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/after')
+        default_factory=lambda: jsonpointer.JsonPointer('/payload/after')
     )
     ref_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/ref')
+        default_factory=lambda: jsonpointer.JsonPointer('/payload/ref')
     )
     repository_selector: JsonPointer = pydantic.Field(
         default_factory=lambda: jsonpointer.JsonPointer(
-            '/repository/full_name'
+            '/payload/repository/full_name'
         )
     )
     api_base_url: str | None = None
     repo_api_url_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/repository/url')
+        default_factory=lambda: jsonpointer.JsonPointer(
+            '/payload/repository/url'
+        )
     )
     initial_limit: int = 100
 
 
 class SyncTagsConfig(pydantic.BaseModel):
-    """``WebhookRule.handler_config`` for ``sync_tags``."""
+    """``WebhookRule.handler_config`` for ``sync_tags``.
+
+    Selectors resolve against the event context, so the push body lives
+    under ``/payload`` (e.g. ``/payload/ref``).
+    """
 
     ref_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/ref')
+        default_factory=lambda: jsonpointer.JsonPointer('/payload/ref')
     )
     after_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/after')
+        default_factory=lambda: jsonpointer.JsonPointer('/payload/after')
     )
     repository_selector: JsonPointer = pydantic.Field(
         default_factory=lambda: jsonpointer.JsonPointer(
-            '/repository/full_name'
+            '/payload/repository/full_name'
         )
     )
     api_base_url: str | None = None
     repo_api_url_selector: JsonPointer = pydantic.Field(
-        default_factory=lambda: jsonpointer.JsonPointer('/repository/url')
+        default_factory=lambda: jsonpointer.JsonPointer(
+            '/payload/repository/url'
+        )
     )
     reconcile_all: bool = False
 
@@ -505,7 +752,7 @@ async def sync_commits(
     credentials: dict[str, str],
     external_identifier: str,
     action_config: SyncCommitsConfig,
-    payload: object,
+    event: object,
 ) -> None:
     """Sync the commits in a ``push`` delivery into the ``commits`` table.
 
@@ -513,32 +760,46 @@ async def sync_commits(
     action does not filter refs itself.
     """
     del external_identifier
-    after = _resolve(action_config.after_selector, payload)
+    after = _resolve(action_config.after_selector, event)
     if not isinstance(after, str) or not after or after == _ZERO_SHA:
         return  # branch delete / no head -- nothing to sync
-    resolved = _resolve_repo_and_base(ctx, action_config, payload)
+    resolved = _resolve_repo_and_base(ctx, action_config, event)
     if resolved is None:
         return
     owner, repo, base = resolved
-    ref_raw = _resolve(action_config.ref_selector, payload)
+    ref_raw = _resolve(action_config.ref_selector, event)
     ref = _branch_short_name(ref_raw if isinstance(ref_raw, str) else '')
-    before = _resolve(action_config.before_selector, payload)
+    before = _resolve(action_config.before_selector, event)
     pushed_at = datetime.datetime.now(datetime.UTC)
     token = await _resolve_bearer(credentials, base, owner, repo)
     async with _client(base, owner, repo, token) as client:
         if isinstance(before, str) and before and before != _ZERO_SHA:
-            raw = await _fetch_compare_commits(client, before, after)
+            raw = await _fetch_compare_commits(
+                client, before, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+            )
         else:
             last = await _last_known_sha(ctx.project_id)
             if last:
-                raw = await _fetch_compare_commits(client, last, after)
+                raw = await _fetch_compare_commits(
+                    client, last, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+                )
             else:
                 raw = await _fetch_recent_commits(
-                    client, after, action_config.initial_limit
+                    client,
+                    after,
+                    action_config.initial_limit,
+                    max_wait=_WEBHOOK_MAX_WAIT_SECONDS,
                 )
+    user_map = await _resolve_author_users(
+        raw, ctx.resolve_user_by_identity, base
+    )
     records: list[pydantic.BaseModel] = [
         _commit_record(
-            item, project_id=ctx.project_id, ref=ref, pushed_at=pushed_at
+            item,
+            project_id=ctx.project_id,
+            ref=ref,
+            pushed_at=pushed_at,
+            author_user=_author_user(item, user_map),
         )
         for item in raw
         if item.get('sha')
@@ -556,29 +817,55 @@ async def sync_commits(
 
 
 async def _annotated_tag(
-    client: httpx.AsyncClient, sha: str
+    client: httpx.AsyncClient, sha: str, *, max_wait: float
 ) -> dict[str, typing.Any] | None:
     """Fetch annotated-tag metadata, ``None`` for a lightweight tag."""
-    resp = await client.get(f'/git/tags/{sha}')
+    resp = await _request(client, 'GET', f'/git/tags/{sha}', max_wait=max_wait)
     if resp.status_code != 200:
         return None
     return typing.cast('dict[str, typing.Any]', resp.json())
 
 
+def _web_base(api_base: str) -> str:
+    """Map a REST API base to the web host (inverse of the routing table).
+
+    ``https://api.github.com`` -> ``https://github.com``;
+    ``https://api.<tenant>.ghe.com`` -> ``https://<tenant>.ghe.com``;
+    GHES ``https://<host>/api/v3`` -> ``https://<host>``.
+    """
+    if api_base.endswith('/api/v3'):
+        return api_base[: -len('/api/v3')]
+    return api_base.replace('://api.', '://', 1)
+
+
+def _tag_web_url(client: httpx.AsyncClient, name: str) -> str:
+    """Build the web URL for *name* from the client's repo-scoped base."""
+    full = str(client.base_url).rstrip('/')
+    marker = '/repos/'
+    idx = full.find(marker)
+    if idx == -1:
+        return ''
+    web = _web_base(full[:idx])
+    owner_repo = full[idx + len(marker) :]
+    return f'{web}/{owner_repo}/releases/tag/{urllib.parse.quote(name)}'
+
+
 def _tag_record(
     *,
     project_id: str,
     name: str,
     sha: str,
     annotated: dict[str, typing.Any] | None = None,
+    url: str = '',
 ) -> TagRecord:
     if annotated is None:
-        return TagRecord(project_id=project_id, name=name, sha=sha)
+        return TagRecord(project_id=project_id, name=name, sha=sha, url=url)
     tagger: dict[str, typing.Any] = annotated.get('tagger') or {}
     return TagRecord(
         project_id=project_id,
         name=name,
         sha=sha,
+        url=url,
         message=str(annotated.get('message') or ''),
         tagger_name=str(tagger.get('name') or ''),
         tagger_email=str(tagger.get('email') or ''),
@@ -587,24 +874,49 @@ def _tag_record(
 
 
 async def _reconcile_tags(
-    client: httpx.AsyncClient, project_id: str
+    client: httpx.AsyncClient, project_id: str, *, max_wait: float
 ) -> list[TagRecord]:
-    """Upsert the repo's full tag list (lightweight); ``ReplacingMergeTree``
-    dedupes against rows recorded from individual pushes."""
+    """Upsert the repo's full tag list via the git-refs API.
+
+    ``/git/matching-refs/tags`` yields each tag's object sha + type;
+    annotated tags (``type == 'tag'``) are enriched with tagger/message/
+    date from the tag object, lightweight tags carry name/sha/url only.
+    ``ReplacingMergeTree`` dedupes against rows recorded from pushes.
+    """
     out: list[TagRecord] = []
+    prefix = 'refs/tags/'
     params: dict[str, str] = {'per_page': '100'}
     while True:
-        resp = await client.get('/tags', params=params)
+        resp = await _request(
+            client,
+            'GET',
+            '/git/matching-refs/tags',
+            params=params,
+            max_wait=max_wait,
+        )
         resp.raise_for_status()
         rows = typing.cast('list[dict[str, typing.Any]]', resp.json())
         for row in rows:
-            name = str(row.get('name') or '')
-            commit: dict[str, typing.Any] = row.get('commit') or {}
-            sha = str(commit.get('sha') or '')
-            if name and sha:
-                out.append(
-                    _tag_record(project_id=project_id, name=name, sha=sha)
+            ref = str(row.get('ref') or '')
+            obj: dict[str, typing.Any] = row.get('object') or {}
+            sha = str(obj.get('sha') or '')
+            if not ref.startswith(prefix) or not sha:
+                continue
+            name = ref[len(prefix) :]
+            annotated = (
+                await _annotated_tag(client, sha, max_wait=max_wait)
+                if obj.get('type') == 'tag'
+                else None
+            )
+            out.append(
+                _tag_record(
+                    project_id=project_id,
+                    name=name,
+                    sha=sha,
+                    annotated=annotated,
+                    url=_tag_web_url(client, name),
                 )
+            )
         next_url = _next_page_url(resp.headers.get('link'))
         if next_url is None:
             return out
@@ -620,16 +932,16 @@ async def sync_tags(
     credentials: dict[str, str],
     external_identifier: str,
     action_config: SyncTagsConfig,
-    payload: object,
+    event: object,
 ) -> None:
     """Sync the tag in a ``push`` delivery into the ``tags`` table."""
     del external_identifier
-    ref_raw = _resolve(action_config.ref_selector, payload)
+    ref_raw = _resolve(action_config.ref_selector, event)
     prefix = 'refs/tags/'
     if not isinstance(ref_raw, str) or not ref_raw.startswith(prefix):
         return
     name = ref_raw[len(prefix) :]
-    after = _resolve(action_config.after_selector, payload)
+    after = _resolve(action_config.after_selector, event)
     if (
         not name
         or not isinstance(after, str)
@@ -637,23 +949,28 @@ async def sync_tags(
         or after == _ZERO_SHA
     ):
         return  # tag delete / no target
-    resolved = _resolve_repo_and_base(ctx, action_config, payload)
+    resolved = _resolve_repo_and_base(ctx, action_config, event)
     if resolved is None:
         return
     owner, repo, base = resolved
     token = await _resolve_bearer(credentials, base, owner, repo)
     async with _client(base, owner, repo, token) as client:
-        annotated = await _annotated_tag(client, after)
+        annotated = await _annotated_tag(
+            client, after, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+        )
         records: list[pydantic.BaseModel] = [
             _tag_record(
                 project_id=ctx.project_id,
                 name=name,
                 sha=after,
                 annotated=annotated,
+                url=_tag_web_url(client, name),
             )
         ]
         if action_config.reconcile_all:
-            extra = await _reconcile_tags(client, ctx.project_id)
+            extra = await _reconcile_tags(
+                client, ctx.project_id, max_wait=_WEBHOOK_MAX_WAIT_SECONDS
+            )
             seen = {name}
             records.extend(r for r in extra if r.name not in seen)
     try:
@@ -798,15 +1115,25 @@ class GitHubCommitSyncPlugin(WebhookActionPlugin):
         pushed_at = datetime.datetime.now(datetime.UTC)
         token = await _resolve_bearer(credentials, base, owner, repo)
         async with _client(base, owner, repo, token) as client:
-            branch = await _fetch_default_branch(client)
-            raw_commits = await _fetch_all_commits(client, branch)
-            tags = await _reconcile_tags(client, ctx.project_id)
+            branch = await _fetch_default_branch(
+                client, max_wait=_BACKFILL_MAX_WAIT_SECONDS
+            )
+            raw_commits = await _fetch_all_commits(
+                client, branch, max_wait=_BACKFILL_MAX_WAIT_SECONDS
+            )
+            tags = await _reconcile_tags(
+                client, ctx.project_id, max_wait=_BACKFILL_MAX_WAIT_SECONDS
+            )
+        user_map = await _resolve_author_users(
+            raw_commits, ctx.resolve_user_by_identity, base
+        )
         commit_records: list[pydantic.BaseModel] = [
             _commit_record(
                 item,
                 project_id=ctx.project_id,
                 ref=branch,
                 pushed_at=pushed_at,
+                author_user=_author_user(item, user_map),
             )
             for item in raw_commits
             if item.get('sha')

{imbi_plugin_github-2.9.2.dist-info → imbi_plugin_github-2.10.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-plugin-github
-Version: 2.9.2
+Version: 2.10.0
 Summary: GitHub identity plugin for Imbi (github.com / GHEC / GHES)
 Author-email: "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
 Requires-Dist: httpx>=0.27
-Requires-Dist: imbi-common[databases]==2.9.2
+Requires-Dist: imbi-common[databases]==2.10.0
 Requires-Dist: pydantic>=2
 Requires-Dist: pyjwt[crypto]>=2.8
 Description-Content-Type: text/markdown

{imbi_plugin_github-2.9.2.dist-info → imbi_plugin_github-2.10.0.dist-info}/RECORD

@@ -2,12 +2,12 @@ imbi_plugin_github/__init__.py,sha256=8ZVhm8XpGqgYRUtpHl0uuZTT3gmMyHNhKd9k6qoatB
 imbi_plugin_github/_app_auth.py,sha256=LnLrvqmu2UC27uHHJfIzFPNDh33RtgeOX1RXceX9Pj0,7000
 imbi_plugin_github/_hosts.py,sha256=jQ1Z6yEpjAa4b7LocLfEelnBcRYYQLNLBNCdWZtAXUc,2258
 imbi_plugin_github/_repos.py,sha256=agp4ZgRuqbrGBRMFeHomnUf1HvvaNvapBCWHQebdviQ,4559
-imbi_plugin_github/commits.py,sha256=okoJd6GM_YlkqyJb3mHlxz58JU7Ar8ve8bQcDkTrkRI,29939
+imbi_plugin_github/commits.py,sha256=hZiTCboherDMY4noKF2T6BKKWMm0uYK4dPAV5c1Giv0,42141
 imbi_plugin_github/deployment.py,sha256=V6YlZX24m33BPJWkC-vCZZLSsH71etkl0xkhkDsKASg,47914
 imbi_plugin_github/identity.py,sha256=RSs1cLQpZmfyQ_0KQkohDIZEBYVBnre6RJIt166EtdQ,15525
 imbi_plugin_github/lifecycle.py,sha256=48mLKjFPG7BOanpA7jWnmbWOdsDLh1F39g2AoxDLL7M,33211
-imbi_plugin_github-2.9.2.dist-info/METADATA,sha256=ACIhGSJ7VSQL2O-v0SmxRAqfov95uaEvWYZsEdjTICc,5809
-imbi_plugin_github-2.9.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-imbi_plugin_github-2.9.2.dist-info/entry_points.txt,sha256=RavN_FYCeS97iauHgCG3tHFdVULbEMXmQfvgCgLeGkI,805
-imbi_plugin_github-2.9.2.dist-info/licenses/LICENSE,sha256=el9B20zOqEcv_mRrHgbdkVyxSC6I8np7am0D6mO2A9Y,1491
-imbi_plugin_github-2.9.2.dist-info/RECORD,,
+imbi_plugin_github-2.10.0.dist-info/METADATA,sha256=iLcyJ1p6YvChsBou6DyMlf-HHq3jDKZ1c-Rn5jPUYc8,5811
+imbi_plugin_github-2.10.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+imbi_plugin_github-2.10.0.dist-info/entry_points.txt,sha256=RavN_FYCeS97iauHgCG3tHFdVULbEMXmQfvgCgLeGkI,805
+imbi_plugin_github-2.10.0.dist-info/licenses/LICENSE,sha256=el9B20zOqEcv_mRrHgbdkVyxSC6I8np7am0D6mO2A9Y,1491
+imbi_plugin_github-2.10.0.dist-info/RECORD,,