openhound-github 0.10.1__tar.gz → 0.12.0__tar.gz

{openhound_github-0.10.1 → openhound_github-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.10.1
+Version: 0.12.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_AppInstallation.md

@@ -2,7 +2,9 @@
 
 ## General Information
 
-Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the app are captured as a JSON string in the properties.
+Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the installation are stored as `scope:access` values such as `contents:write` in the `permissions` property.
+
+Unlike fine-grained personal access tokens, GitHub does not expose separate organization and repository permission buckets for app installations, so this property remains a single flat permission list.
 
 Each installation is linked to its parent GH_App via a GH_InstalledAs edge. For installations with `repository_selection` set to `all`, GH_CanAccess edges are created to every repository in the organization. For installations with `repository_selection` set to `selected`, repository-level edges cannot be enumerated with a PAT (requires app installation token authentication).
 
@@ -24,7 +26,7 @@ Each installation is linked to its parent GH_App via a GH_InstalledAs edge. For
 | `repositories_url` | `string` | API URL to list repositories accessible to this installation. |
 | `repository_selection` | `string` | Whether the app has access to `all` repositories or `selected` repositories. |
 | `target_type` | `string` | The target type of the installation (e.g., `Organization`). |
-| `permissions` | `string` | JSON string of the permissions granted to the app (e.g., `{"contents": "read", "metadata": "read"}`). |
+| `permissions` | `list[string]` | Permissions granted to the installation in `scope:access` form. |
 | `events` | `string` | JSON string of the webhook events the app subscribes to. |
 | `created_at` | `datetime` | When the app was installed. |
 | `updated_at` | `datetime` | When the installation was last updated. |

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_Enterprise.md

@@ -23,8 +23,9 @@ A GitHub Enterprise account that contains organizations, enterprise teams, roles
 | `created_at` | `string` | When the enterprise was created. |
 | `updated_at` | `string` | When the enterprise was last updated. |
 | `billing_email` | `string` | The enterprise billing email. |
-| `security_contact_email` | `string` | The enterprise security contact email. |
 | `viewer_is_admin` | `boolean` | Whether the authenticated viewer is an enterprise admin. |
+| `github_deployment_type` | `string` | The GitHub deployment type, such as `ghec` or `ghes`. |
+| `ghes_version` | `string` | The GitHub Enterprise Server version, when applicable. |
 | `environment_name` | `string` | The enterprise environment name. |
 | `query_organizations` | `string` | Query for contained organizations. |
 

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_EnterpriseRunner.md

@@ -44,9 +44,6 @@ When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges ide
 graph LR
     n0["GH_EnterpriseRunnerGroup"]
     n1["GH_EnterpriseRunner"]
-    n2["GH_WorkflowJob"]
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasRunner| n1
-    n2 -.->|GH_RunsOn| n1
-    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_Environment.md

@@ -59,5 +59,4 @@ graph LR
     n8 -.->|GH_ApprovesDeploymentTo| n1
     n8 -->|GH_CanDeployToEnvironment| n1
     n9 -.->|GH_DeploysTo| n1
-    n9 -->|GH_CanRequestOIDCTokenFor| n1
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_EnvironmentSecret.md

@@ -33,6 +33,7 @@ graph LR
     n3["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasSecret| n1
+    n2 -->|GH_CanAccessSecret| n1
     n2 -.->|GH_UsesSecret| n1
     n3 -.->|GH_UsesSecret| n1
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_OrgRunner.md

@@ -44,9 +44,6 @@ When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges ide
 graph LR
     n0["GH_OrgRunnerGroup"]
     n1["GH_OrgRunner"]
-    n2["GH_WorkflowJob"]
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasRunner| n1
-    n2 -.->|GH_RunsOn| n1
-    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_OrgSecret.md

@@ -33,6 +33,7 @@ graph LR
     n0 -->|GH_CanReadSecret| n1
     n2 -.->|GH_Contains| n1
     n3 -->|GH_HasSecret| n1
+    n4 -->|GH_CanAccessSecret| n1
     n4 -.->|GH_UsesSecret| n1
     n5 -.->|GH_UsesSecret| n1
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_Organization.md

@@ -72,6 +72,8 @@ Represents a GitHub organization. This is the root node of the graph and serves
 | `self_hosted_runners_enabled_repositories` | `string` | Which repositories may use self-hosted runners: `all`, `selected`, or `none`. |
 | `default_workflow_permissions` | `string` | The default workflow permissions property. |
 | `can_approve_pull_request_reviews` | `boolean` | The can approve pull request reviews property. |
+| `github_deployment_type` | `string` | The GitHub deployment type, such as `ghec` or `ghes`. |
+| `ghes_version` | `string` | The GitHub Enterprise Server version, when applicable. |
 | `query_organization_roles` | `string` | Query for organization roles. |
 | `query_users` | `string` | Query for users. |
 | `query_teams` | `string` | Query for teams. |

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_PersonalAccessToken.md

@@ -2,7 +2,9 @@
 
 ## General Information
 
-Represents a fine-grained personal access token that has been granted access to organization resources. PATs are linked to their owning user, the organization, and the repositories they can access. The permissions granted to the token are captured as a JSON string in the properties.
+Represents a fine-grained personal access token that has been granted access to organization resources. PATs are linked to their owning user, the organization, and the repositories they can access.
+
+The granted permissions are stored separately as `organization_permissions` and `repository_permissions`. Each property is a list of `scope:access` values such as `members:read` or `contents:write`, matching the permission format used on GH_WorkflowJob nodes.
 
 ## Properties
 
@@ -18,9 +20,9 @@ Represents a fine-grained personal access token that has been granted access to
 | `owner_node_id` | `string` | The GraphQL node ID of the token owner. |
 | `token_expires_at` | `datetime` | The ISO 8601 timestamp of when the token expires. |
 | `token_last_used_at` | `datetime` | The ISO 8601 timestamp of when the token was last used. |
-| `access_granted_at` | `datetime` | The ISO 8601 timestamp of when the token was granted to the organization. |. |
-| `organization_permissions` | `string` | JSON string of the PAT's organization-scoped permissions. |
-| `repository_permissions` | `string` | JSON string of the PAT's repository-scoped permissions. |
+| `access_granted_at` | `datetime` | The ISO 8601 timestamp of when the token was granted to the organization. |
+| `organization_permissions` | `list[string]` | Organization-scoped permissions in `scope:access` form. |
+| `repository_permissions` | `list[string]` | Repository-scoped permissions in `scope:access` form. |
 | `token_name` | `string` | The user-assigned display name of the token. |
 | `owner_login` | `string` | The login handle of the user who owns the token. |
 | `repository_selection` | `string` | Whether the token has access to `all`, `subset`, or `none` of the organization's repositories. |

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_PersonalAccessTokenRequest.md

@@ -2,7 +2,9 @@
 
 ## General Information
 
-Represents a pending request from an organization member to access organization resources with a fine-grained personal access token. PAT requests are linked to their owning user and the organization. The requested permissions are captured as a JSON string in the properties.
+Represents a pending request from an organization member to access organization resources with a fine-grained personal access token. PAT requests are linked to their owning user and the organization.
+
+The requested permissions are stored separately as `organization_permissions` and `repository_permissions`. Each property is a list of `scope:access` values such as `members:read` or `contents:write`, matching the permission format used on GH_WorkflowJob nodes.
 
 ## Properties
 
@@ -18,6 +20,8 @@ Represents a pending request from an organization member to access organization
 | `repository_selection` | `string` | Whether the request targets `all`, `subset`, or `none` of the organization's repositories. |
 | `reason` | `string` | The rationale provided by the requester for the access request. |
 | `org_name` | `string` | The org name property. |
+| `organization_permissions` | `list[string]` | Requested organization-scoped permissions in `scope:access` form. |
+| `repository_permissions` | `list[string]` | Requested repository-scoped permissions in `scope:access` form. |
 | `query_organization_permissions` | `string` | Query for organization permissions. |
 | `query_user` | `string` | Query for user. |
 | `query_repositories` | `string` | Query for repositories. |

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_RepoRunner.md

@@ -44,9 +44,6 @@ When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges ide
 graph LR
     n0["GH_Repository"]
     n1["GH_RepoRunner"]
-    n2["GH_WorkflowJob"]
     n0 -.->|GH_CanUseRunner| n1
     n0 -.->|GH_Contains| n1
-    n2 -.->|GH_RunsOn| n1
-    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_RepoSecret.md

@@ -31,6 +31,7 @@ graph LR
     n3["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasSecret| n1
+    n2 -->|GH_CanAccessSecret| n1
     n2 -.->|GH_UsesSecret| n1
     n3 -.->|GH_UsesSecret| n1
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_Repository.md

@@ -6,6 +6,8 @@ Represents a GitHub repository within the organization. Repository nodes capture
 
 For repositories with active workflows, the collector records the applicable default workflow permissions and whether workflows may approve pull request reviews. These properties preserve the repository-level policy input later used to derive effective GITHUB_TOKEN permissions for GH_WorkflowJob nodes.
 
+The `branch_count` and `environment_count` properties preserve GitHub-reported totals from the repository GraphQL response. These values can be compared to collected GH_Branch and GH_Environment children to identify incomplete collection before relying on branch- or environment-dependent analysis.
+
 ## Properties
 
 | Property | Type | Description |
@@ -39,11 +41,13 @@ For repositories with active workflows, the collector records the applicable def
 | `environment_name` | `string` | The name of the environment (GitHub organization). |
 | `actions_enabled` | `boolean` | Whether GitHub Actions is enabled for this repository. |
 | `self_hosted_runners_enabled` | `boolean` | Whether the repository may use self-hosted runners. |
+| `default_workflow_permissions` | `string` | The repository's applicable default GITHUB_TOKEN workflow permissions. |
+| `can_approve_pull_request_reviews` | `boolean` | Whether workflows may approve pull request reviews. |
 | `secret_scanning` | `string` | Status of secret scanning (e.g., `enabled`, `disabled`). |
 | `branch_ruleset_count` | `integer` | Number of branch-targeted rulesets that apply to this repository. |
 | `has_branch_rulesets` | `boolean` | Whether at least one branch-targeted ruleset applies to this repository. |
-| `default_workflow_permissions` | `string` | The repository's applicable default GITHUB_TOKEN workflow permissions. |
-| `can_approve_pull_request_reviews` | `boolean` | Whether workflows may approve pull request reviews. |
+| `branch_count` | `integer` | Number of branch refs reported by GitHub for this repository. |
+| `environment_count` | `integer` | Number of deployment environments reported by GitHub for this repository. |
 | `query_branches` | `string` | Query for branches. |
 | `query_protected_branches` | `string` | Query for protected branches. |
 | `query_branch_protection_rules` | `string` | Query for branch protection rules. |

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_Runner.md

@@ -19,4 +19,7 @@ Generic label applied to GitHub self-hosted runner nodes across enterprise, orga
 ```mermaid
 graph LR
     n0["GH_Runner"]
+    n1["GH_WorkflowJob"]
+    n0 -->|GH_CanInterceptJob| n1
+    n1 -.->|GH_RunsOn| n0
 ```

{openhound_github-0.10.1 → openhound_github-0.12.0}/descriptions/nodes/GH_WorkflowJob.md

@@ -47,32 +47,32 @@ When `runs_on_is_dynamic` is true, runner matching and interception status remai
 
 ```mermaid
 graph LR
-    n0["GH_Workflow"]
+    n0["GH_Runner"]
     n1["GH_WorkflowJob"]
-    n2["GH_Environment"]
-    n3["GH_EnvironmentSecret"]
-    n4["GH_EnvironmentVariable"]
-    n5["GH_OrgSecret"]
-    n6["GH_OrgVariable"]
-    n7["GH_RepoSecret"]
-    n8["GH_RepoVariable"]
-    n9["GH_Runner"]
+    n2["GH_Workflow"]
+    n3["GH_Environment"]
+    n4["GH_EnvironmentSecret"]
+    n5["GH_EnvironmentVariable"]
+    n6["GH_OrgSecret"]
+    n7["GH_OrgVariable"]
+    n8["GH_RepoSecret"]
+    n9["GH_RepoVariable"]
     n10["GH_WorkflowStep"]
-    n0 -.->|GH_Contains| n1
-    n1 -.->|GH_DeploysTo| n2
-    n1 -.->|GH_UsesSecret| n3
-    n1 -.->|GH_UsesVariable| n4
-    n1 -.->|GH_UsesSecret| n5
-    n1 -.->|GH_UsesVariable| n6
-    n1 -.->|GH_UsesSecret| n7
-    n1 -.->|GH_UsesVariable| n8
-    n1 -.->|GH_RunsOn| n9
-    n1 -->|GH_CanAccessSecret| n3
-    n1 -->|GH_CanAccessSecret| n5
-    n1 -->|GH_CanAccessSecret| n7
-    n1 -->|GH_CanRequestOIDCTokenFor| n2
-    n9 -->|GH_CanInterceptJob| n1
-    n1 -.->|GH_CallsWorkflow| n0
+    n0 -->|GH_CanInterceptJob| n1
+    n2 -.->|GH_Contains| n1
+    n1 -->|GH_CanRequestOIDCTokenFor| n3
+    n1 -.->|GH_DeploysTo| n3
+    n1 -->|GH_CanAccessSecret| n4
+    n1 -.->|GH_UsesSecret| n4
+    n1 -.->|GH_UsesVariable| n5
+    n1 -->|GH_CanAccessSecret| n6
+    n1 -.->|GH_UsesSecret| n6
+    n1 -.->|GH_UsesVariable| n7
+    n1 -->|GH_CanAccessSecret| n8
+    n1 -.->|GH_UsesSecret| n8
+    n1 -.->|GH_UsesVariable| n9
+    n1 -.->|GH_RunsOn| n0
+    n1 -.->|GH_CallsWorkflow| n2
     n1 -.->|GH_DependsOn| n1
     n1 -.->|GH_Contains| n10
 ```

openhound_github-0.12.0/extension/privilege_zone_rules/t0-app-installations-all-repos.json

@@ -0,0 +1,8 @@
+{
+  "name": "GitHub: Tier Zero App Installations (All Repositories)",
+  "description": "GitHub App installations scoped to all repositories in the organization that have repository-control write permissions. A compromised app credential may grant code, workflow, Actions, or administrative control across every repository. Installations with only read or lower-impact write permissions are excluded.",
+  "cypher": "MATCH (n:GH_AppInstallation {repository_selection:'all'})\nWHERE ANY(permission IN n.permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
+  "enabled": true,
+  "zone": "Tier Zero",
+  "allow_disable": true
+}

openhound_github-0.12.0/extension/privilege_zone_rules/t0-apps-all-repos.json

@@ -0,0 +1,8 @@
+{
+  "name": "GitHub: Tier Zero Apps (All-Repository Installations)",
+  "description": "GitHub App definitions whose installations have repository-control write permissions across all repositories. The app owner controls the private key that can generate tokens for any installation. Compromise of the app's private key may grant code, workflow, Actions, or administrative control across every repository in organizations where it is installed. Apps whose installations have only read or lower-impact write permissions are excluded.",
+  "cypher": "MATCH (n:GH_App)-[:GH_InstalledAs]->(i:GH_AppInstallation {repository_selection:'all'})\nWHERE ANY(permission IN i.permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
+  "enabled": true,
+  "zone": "Tier Zero",
+  "allow_disable": true
+}

openhound_github-0.12.0/extension/privilege_zone_rules/t0-pats-all-repos.json

@@ -0,0 +1,8 @@
+{
+  "name": "GitHub: Tier Zero PATs (All Repositories)",
+  "description": "Fine-grained personal access tokens scoped to all repositories in the organization that have repository-control write permissions. A single compromised token may grant code, workflow, Actions, or administrative control across every repository. PATs with only read or lower-impact write permissions are excluded.",
+  "cypher": "MATCH (n:GH_PersonalAccessToken {repository_selection:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
+  "enabled": true,
+  "zone": "Tier Zero",
+  "allow_disable": true
+}

{openhound_github-0.10.1 → openhound_github-0.12.0}/scripts/generate_gh_description_docs.py

@@ -175,7 +175,12 @@ def extract_general_information(path: Path) -> str | None:
         text = text[match.end() :].strip()
     else:
         text = re.sub(r"^# .+?\n+", "", text, count=1).strip()
-    text = re.split(r"^## Diagram\s*$", text, maxsplit=1, flags=re.MULTILINE)[0].strip()
+    text = re.split(
+        r"^## (?:Properties|Edge Schema|Diagram)\s*$",
+        text,
+        maxsplit=1,
+        flags=re.MULTILINE,
+    )[0].strip()
     text = re.sub(r"\n```mermaid\n.*?\n```\s*$", "", text, flags=re.DOTALL).strip()
     return text or None
 

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/graphql.py

@@ -271,6 +271,7 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     totalCount
                 }
                 refs(first: 100, refPrefix: "refs/heads/") {
+                    totalCount
                     nodes {
                         id
                         name
@@ -279,6 +280,9 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     }
                     pageInfo { endCursor hasNextPage }
                 }
+                environments(first: 1) {
+                    totalCount
+                }
             }
             pageInfo { endCursor hasNextPage }
         }

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/lookup.py

@@ -278,6 +278,16 @@ class GithubLookup(LookupManager):
         if actions_enabled is not True:
             return []
 
+        org_node_id = self.org_id_for_login(org_login)
+        if not org_node_id:
+            return [
+                (node_id, ephemeral)
+                for _source_order, node_id, ephemeral in sorted(
+                    matching_runners,
+                    key=lambda runner: (runner[0], runner[1]),
+                )
+            ]
+
         for (
             runner_group_id,
             runner_group_name,
@@ -320,9 +330,6 @@ class GithubLookup(LookupManager):
                 continue
 
             if inherited:
-                org_node_id = self.org_id_for_login(org_login)
-                if not org_node_id:
-                    continue
                 if (
                     self.enterprise_runner_group_restricted_to_workflows_for_inherited_org_group(
                         org_node_id, runner_group_name
@@ -370,7 +377,7 @@ class GithubLookup(LookupManager):
             ):
                 add_matching_runner(
                     1,
-                    runner_node_id(self.org_id_for_login(org_login), int(runner_id)),
+                    runner_node_id(org_node_id, int(runner_id)),
                     raw_labels,
                     ephemeral,
                 )
@@ -595,6 +602,25 @@ class GithubLookup(LookupManager):
             return None
         return int(row[0])
 
+    @lru_cache
+    def repository_graphql_counts(
+        self, repository_node_id: str
+    ) -> tuple[int | None, int | None]:
+        row = self._find_single_row(
+            f"""
+            SELECT branch_count, environment_count
+            FROM {self.schema}.repositories_graphql
+            WHERE id = ?
+            """,
+            [repository_node_id],
+        )
+        if row is None:
+            return None, None
+        return (
+            None if row[0] is None else int(row[0]),
+            None if row[1] is None else int(row[1]),
+        )
+
     @lru_cache
     def repository_workflow_permissions(
         self, repository_node_id: str

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/models/app_installation.py

@@ -12,6 +12,7 @@ from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
+from openhound_github.models.permissions import normalize_permission_declaration
 
 
 @dataclass
@@ -28,7 +29,7 @@ class GHAppInstallationProperties(GHNodeProperties):
         repositories_url: API URL to list repositories accessible to this installation.
         repository_selection: Whether the app has access to `all` repositories or `selected` repositories.
         target_type: The target type of the installation (e.g., `Organization`).
-        permissions: JSON string of the permissions granted to the app (e.g., `{"contents": "read", "metadata": "read"}`).
+        permissions: Permissions granted to the installation in `scope:access` form.
         events: JSON string of the webhook events the app subscribes to.
         created_at: When the app was installed.
         updated_at: When the installation was last updated.
@@ -47,7 +48,7 @@ class GHAppInstallationProperties(GHNodeProperties):
     repositories_url: str | None = None
     repository_selection: str | None = None
     target_type: str | None = None
-    permissions: str | None = None
+    permissions: list[str] | None = None
     events: str | None = None
     created_at: datetime | None = None
     updated_at: datetime | None = None
@@ -141,7 +142,7 @@ class AppInstallation(BaseAsset):
                 repositories_url=self.repositories_url,
                 repository_selection=self.repository_selection,
                 target_type=self.target_type,
-                permissions=json.dumps(self.permissions) if self.permissions else None,
+                permissions=normalize_permission_declaration(self.permissions),
                 events=json.dumps(self.events) if self.events else None,
                 created_at=self.created_at,
                 updated_at=self.updated_at,

openhound_github-0.12.0/src/openhound_github/models/permissions.py

@@ -0,0 +1,18 @@
+from typing import Any
+
+
+def normalize_permission_declaration(value: Any) -> list[str] | None:
+    """Normalize GitHub permission payloads into query-friendly scope:access values."""
+    if value is None:
+        return None
+
+    if isinstance(value, str):
+        return [value]
+
+    if isinstance(value, list):
+        return [str(item) for item in value]
+
+    if isinstance(value, dict):
+        return [f"{key!s}:{item!s}" for key, item in value.items()]
+
+    return [str(value)]

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/models/personal_access_token.py

@@ -2,7 +2,6 @@ from dataclasses import dataclass
 from datetime import datetime
 from typing import ClassVar
 
-from dlt.common import json
 from dlt.common.libs.pydantic import DltConfig
 from openhound.core.asset import BaseAsset, EdgeDef, NodeDef
 from openhound.core.models.entries_dataclass import Edge, EdgePath, EdgeProperties
@@ -12,6 +11,7 @@ from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
+from openhound_github.models.permissions import normalize_permission_declaration
 
 
 class Permissions(BaseModel):
@@ -35,10 +35,10 @@ class GHPersonalAccessTokenProperties(GHNodeProperties):
         owner_id: The GitHub ID of the token owner.
         owner_node_id: The GraphQL node ID of the token owner.
         token_expires_at: The ISO 8601 timestamp of when the token expires.
-        organization_permissions: JSON string of the PAT's organization-scoped permissions.
-        repository_permissions: JSON string of the PAT's repository-scoped permissions.
+        organization_permissions: Organization-scoped permissions in `scope:access` form.
+        repository_permissions: Repository-scoped permissions in `scope:access` form.
         token_last_used_at: The ISO 8601 timestamp of when the token was last used.
-        access_granted_at: The ISO 8601 timestamp of when the token was granted to the organization. |
+        access_granted_at: The ISO 8601 timestamp of when the token was granted to the organization.
         token_name: The user-assigned display name of the token.
         owner_login: The login handle of the user who owns the token.
         repository_selection: Whether the token has access to `all`, `subset`, or `none` of the organization's repositories.
@@ -55,8 +55,8 @@ class GHPersonalAccessTokenProperties(GHNodeProperties):
     token_expires_at: datetime | None = None
     token_last_used_at: datetime | None = None
     access_granted_at: datetime | None = None
-    organization_permissions: str | None = None
-    repository_permissions: str | None = None
+    organization_permissions: list[str] | None = None
+    repository_permissions: list[str] | None = None
     token_name: str | None = None
     owner_login: str | None = None
     repository_selection: str | None = None
@@ -144,15 +144,11 @@ class PersonalAccessToken(BaseAsset):
                 environment_name=self.org_login,
                 token_expires_at=self.token_expires_at,
                 owner_id=self.owner.id if self.owner else None,
-                organization_permissions=(
-                    json.dumps(self.permissions.organization)
-                    if self.permissions and self.permissions.organization
-                    else None
+                organization_permissions=normalize_permission_declaration(
+                    self.permissions.organization if self.permissions else None
                 ),
-                repository_permissions=(
-                    json.dumps(self.permissions.repository)
-                    if self.permissions and self.permissions.repository
-                    else None
+                repository_permissions=normalize_permission_declaration(
+                    self.permissions.repository if self.permissions else None
                 ),
                 token_last_used_at=self.token_last_used_at,
                 query_organization_permissions=f"MATCH p=(:GH_PersonalAccessToken {{node_id:'{pid}'}})-[:GH_CanAccess]->(:GH_Organization) RETURN p",

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/models/personal_access_token_request.py

@@ -9,6 +9,7 @@ from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
+from openhound_github.models.permissions import normalize_permission_declaration
 
 
 class Owner(BaseModel):
@@ -29,19 +30,23 @@ class GHPersonalAccessTokenRequestProperties(GHNodeProperties):
         repository_selection: Whether the request targets `all`, `subset`, or `none` of the organization's repositories.
         reason: The rationale provided by the requester for the access request.
         org_name: The org name property.
+        organization_permissions: Requested organization-scoped permissions in `scope:access` form.
+        repository_permissions: Requested repository-scoped permissions in `scope:access` form.
         query_organization_permissions: Query for organization permissions.
         query_user: Query for user.
         query_repositories: Query for repositories.
     """
 
     # TODO: Check for the following fields
-    # owner_id, owner_node_id, toke_id, token_expires_at, token_last_used_at, permissions, and environment_name
+    # owner_id, owner_node_id, toke_id, token_expires_at, token_last_used_at, and environment_name
 
     token_name: str | None = None
     owner_login: str | None = None
     repository_selection: str | None = None
     reason: str | None = None
     org_name: str | None = None
+    organization_permissions: list[str] | None = None
+    repository_permissions: list[str] | None = None
     query_organization_permissions: str | None = None
     query_user: str | None = None
     query_repositories: str | None = None
@@ -102,6 +107,7 @@ class PersonalAccessTokenRequest(BaseAsset):
     @property
     def as_node(self) -> GHNode:
         rid = self.node_id
+        permissions = self.permissions or {}
         return GHNode(
             kinds=[nk.PERSONAL_ACCESS_TOKEN_REQUEST],
             properties=GHPersonalAccessTokenRequestProperties(
@@ -114,6 +120,12 @@ class PersonalAccessTokenRequest(BaseAsset):
                 repository_selection=self.repository_selection,
                 reason=self.reason,
                 org_name=self.org_login,
+                organization_permissions=normalize_permission_declaration(
+                    permissions.get("organization")
+                ),
+                repository_permissions=normalize_permission_declaration(
+                    permissions.get("repository")
+                ),
                 query_organization_permissions=f"MATCH p=(:GH_PersonalAccessTokenRequest {{node_id:'{rid}'}})-[:GH_CanAccess]->(:GH_Organization) RETURN p",
                 query_user=f"MATCH p=(:GH_User)-[:GH_HasPersonalAccessTokenRequest]->(:GH_PersonalAccessTokenRequest {{node_id:'{rid}'}}) RETURN p",
                 query_repositories=f"MATCH p=(:GH_PersonalAccessTokenRequest {{node_id:'{rid}'}})-[:GH_CanAccess]->(:GH_Repository) RETURN p LIMIT 1000",

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/models/repository.py

@@ -46,6 +46,8 @@ class GHRepositoryProperties(GHNodeProperties):
         secret_scanning: Status of secret scanning (e.g., `enabled`, `disabled`).
         branch_ruleset_count: Number of branch-targeted rulesets that apply to this repository.
         has_branch_rulesets: Whether at least one branch-targeted ruleset applies to this repository.
+        branch_count: Number of branch refs reported by GitHub for this repository.
+        environment_count: Number of deployment environments reported by GitHub for this repository.
         query_branches: Query for branches.
         query_protected_branches: Query for protected branches.
         query_branch_protection_rules: Query for branch protection rules.
@@ -94,6 +96,8 @@ class GHRepositoryProperties(GHNodeProperties):
     secret_scanning: str | None = None
     branch_ruleset_count: int | None = None
     has_branch_rulesets: bool | None = None
+    branch_count: int | None = None
+    environment_count: int | None = None
     query_branches: str | None = None
     query_protected_branches: str | None = None
     query_branch_protection_rules: str | None = None
@@ -149,6 +153,7 @@ class Branch(BaseModel):
 class Ref(BaseModel):
     page_info: PageInfo = Field(alias="pageInfo")
     nodes: list[Branch]
+    total_count: int | None = Field(alias="totalCount", default=None)
 
 
 class RepositoryQL(BaseModel):
@@ -158,6 +163,8 @@ class RepositoryQL(BaseModel):
     name: str
     refs: Ref
     branch_ruleset_count: int | None = None
+    branch_count: int | None = None
+    environment_count: int | None = None
 
     # Additional
     org_login: str
@@ -230,6 +237,7 @@ class Repository(BaseAsset):
     def as_node(self) -> GHNode:
         rid = self.node_id
         branch_ruleset_count = self._lookup.repository_branch_ruleset_count(rid)
+        branch_count, environment_count = self._lookup.repository_graphql_counts(rid)
         workflow_permissions = self._lookup.repository_workflow_permissions(rid)
         default_workflow_permissions, can_approve_pull_request_reviews = (
             workflow_permissions if workflow_permissions else (None, None)
@@ -272,6 +280,8 @@ class Repository(BaseAsset):
                     if branch_ruleset_count is not None
                     else None
                 ),
+                branch_count=branch_count,
+                environment_count=environment_count,
                 # secret_scanning=self.secret_scanning,
                 query_branches=f"MATCH p=(:GH_Repository {{node_id: '{rid}'}})-[:GH_Contains]->(:GH_Branch) RETURN p",
                 query_protected_branches=f"MATCH p=(:GH_Repository {{node_id: '{rid}'}})-[:GH_Contains]->(:GH_Branch)<-[:GH_ProtectedBy]-(:GH_BranchProtectionRule) RETURN p",

{openhound_github-0.10.1 → openhound_github-0.12.0}/src/openhound_github/models/workflow.py

@@ -24,6 +24,7 @@ from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
+from openhound_github.models.permissions import normalize_permission_declaration
 
 
 class GithubActionsLoader(yaml.SafeLoader):
@@ -124,22 +125,6 @@ READ_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES = {"models", "vulnerability-alerts"}
 WRITE_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES = {"id-token"}
 
 
-def normalize_permission_declaration(value: Any) -> list[str] | None:
-    if value is None:
-        return None
-
-    if isinstance(value, str):
-        return [value]
-
-    if isinstance(value, list):
-        return [str(item) for item in value]
-
-    if isinstance(value, dict):
-        return [f"{key!s}:{item!s}" for key, item in value.items()]
-
-    return [str(value)]
-
-
 def _empty_github_token_permissions() -> dict[str, str]:
     return {scope: "none" for scope in GITHUB_TOKEN_PERMISSION_SCOPES}