openhound-github 0.11.0__tar.gz → 0.12.0__tar.gz

{openhound_github-0.11.0 → openhound_github-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.11.0
+Version: 0.12.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.11.0 → openhound_github-0.12.0}/descriptions/nodes/GH_Environment.md

@@ -59,5 +59,4 @@ graph LR
     n8 -.->|GH_ApprovesDeploymentTo| n1
     n8 -->|GH_CanDeployToEnvironment| n1
     n9 -.->|GH_DeploysTo| n1
-    n9 -->|GH_CanRequestOIDCTokenFor| n1
 ```

{openhound_github-0.11.0 → openhound_github-0.12.0}/descriptions/nodes/GH_Repository.md

@@ -6,6 +6,8 @@ Represents a GitHub repository within the organization. Repository nodes capture
 
 For repositories with active workflows, the collector records the applicable default workflow permissions and whether workflows may approve pull request reviews. These properties preserve the repository-level policy input later used to derive effective GITHUB_TOKEN permissions for GH_WorkflowJob nodes.
 
+The `branch_count` and `environment_count` properties preserve GitHub-reported totals from the repository GraphQL response. These values can be compared to collected GH_Branch and GH_Environment children to identify incomplete collection before relying on branch- or environment-dependent analysis.
+
 ## Properties
 
 | Property | Type | Description |
@@ -44,6 +46,8 @@ For repositories with active workflows, the collector records the applicable def
 | `secret_scanning` | `string` | Status of secret scanning (e.g., `enabled`, `disabled`). |
 | `branch_ruleset_count` | `integer` | Number of branch-targeted rulesets that apply to this repository. |
 | `has_branch_rulesets` | `boolean` | Whether at least one branch-targeted ruleset applies to this repository. |
+| `branch_count` | `integer` | Number of branch refs reported by GitHub for this repository. |
+| `environment_count` | `integer` | Number of deployment environments reported by GitHub for this repository. |
 | `query_branches` | `string` | Query for branches. |
 | `query_protected_branches` | `string` | Query for protected branches. |
 | `query_branch_protection_rules` | `string` | Query for branch protection rules. |

{openhound_github-0.11.0 → openhound_github-0.12.0}/src/openhound_github/graphql.py

@@ -271,6 +271,7 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     totalCount
                 }
                 refs(first: 100, refPrefix: "refs/heads/") {
+                    totalCount
                     nodes {
                         id
                         name
@@ -279,6 +280,9 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     }
                     pageInfo { endCursor hasNextPage }
                 }
+                environments(first: 1) {
+                    totalCount
+                }
             }
             pageInfo { endCursor hasNextPage }
         }

{openhound_github-0.11.0 → openhound_github-0.12.0}/src/openhound_github/lookup.py

@@ -602,6 +602,25 @@ class GithubLookup(LookupManager):
             return None
         return int(row[0])
 
+    @lru_cache
+    def repository_graphql_counts(
+        self, repository_node_id: str
+    ) -> tuple[int | None, int | None]:
+        row = self._find_single_row(
+            f"""
+            SELECT branch_count, environment_count
+            FROM {self.schema}.repositories_graphql
+            WHERE id = ?
+            """,
+            [repository_node_id],
+        )
+        if row is None:
+            return None, None
+        return (
+            None if row[0] is None else int(row[0]),
+            None if row[1] is None else int(row[1]),
+        )
+
     @lru_cache
     def repository_workflow_permissions(
         self, repository_node_id: str

{openhound_github-0.11.0 → openhound_github-0.12.0}/src/openhound_github/models/repository.py

@@ -46,6 +46,8 @@ class GHRepositoryProperties(GHNodeProperties):
         secret_scanning: Status of secret scanning (e.g., `enabled`, `disabled`).
         branch_ruleset_count: Number of branch-targeted rulesets that apply to this repository.
         has_branch_rulesets: Whether at least one branch-targeted ruleset applies to this repository.
+        branch_count: Number of branch refs reported by GitHub for this repository.
+        environment_count: Number of deployment environments reported by GitHub for this repository.
         query_branches: Query for branches.
         query_protected_branches: Query for protected branches.
         query_branch_protection_rules: Query for branch protection rules.
@@ -94,6 +96,8 @@ class GHRepositoryProperties(GHNodeProperties):
     secret_scanning: str | None = None
     branch_ruleset_count: int | None = None
     has_branch_rulesets: bool | None = None
+    branch_count: int | None = None
+    environment_count: int | None = None
     query_branches: str | None = None
     query_protected_branches: str | None = None
     query_branch_protection_rules: str | None = None
@@ -149,6 +153,7 @@ class Branch(BaseModel):
 class Ref(BaseModel):
     page_info: PageInfo = Field(alias="pageInfo")
     nodes: list[Branch]
+    total_count: int | None = Field(alias="totalCount", default=None)
 
 
 class RepositoryQL(BaseModel):
@@ -158,6 +163,8 @@ class RepositoryQL(BaseModel):
     name: str
     refs: Ref
     branch_ruleset_count: int | None = None
+    branch_count: int | None = None
+    environment_count: int | None = None
 
     # Additional
     org_login: str
@@ -230,6 +237,7 @@ class Repository(BaseAsset):
     def as_node(self) -> GHNode:
         rid = self.node_id
         branch_ruleset_count = self._lookup.repository_branch_ruleset_count(rid)
+        branch_count, environment_count = self._lookup.repository_graphql_counts(rid)
         workflow_permissions = self._lookup.repository_workflow_permissions(rid)
         default_workflow_permissions, can_approve_pull_request_reviews = (
             workflow_permissions if workflow_permissions else (None, None)
@@ -272,6 +280,8 @@ class Repository(BaseAsset):
                     if branch_ruleset_count is not None
                     else None
                 ),
+                branch_count=branch_count,
+                environment_count=environment_count,
                 # secret_scanning=self.secret_scanning,
                 query_branches=f"MATCH p=(:GH_Repository {{node_id: '{rid}'}})-[:GH_Contains]->(:GH_Branch) RETURN p",
                 query_protected_branches=f"MATCH p=(:GH_Repository {{node_id: '{rid}'}})-[:GH_Contains]->(:GH_Branch)<-[:GH_ProtectedBy]-(:GH_BranchProtectionRule) RETURN p",

{openhound_github-0.11.0 → openhound_github-0.12.0}/src/openhound_github/resources/organization.py

@@ -1224,10 +1224,14 @@ def repositories_graphql(ctx: SourceContext):
                 for repo in repos_page["nodes"]:
                     repo_record = {**repo}
                     branch_rulesets = repo_record.pop("branchRulesets", None) or {}
+                    environments = repo_record.pop("environments", None) or {}
+                    refs = repo_record.get("refs") or {}
                     emitted_repositories += 1
                     yield {
                         **repo_record,
                         "branch_ruleset_count": branch_rulesets.get("totalCount"),
+                        "branch_count": refs.get("totalCount"),
+                        "environment_count": environments.get("totalCount"),
                         "org_login": org_name,
                     }
 
@@ -1447,20 +1451,23 @@ def workflow_steps(workflow: Workflow):
 
 
 @app.transformer(name="environments", columns=Environment, parallelized=True)
-def environments(repo: Repository, ctx: SourceContext):
+def environments(repo: RepositoryQL, ctx: SourceContext):
     """Fetch deployment environments for a repository.
 
     Args:
-        repo (Repository): The repository to fetch environments for.
+        repo (RepositoryQL): Repository metadata with the GitHub-reported environment count.
         ctx (SourceContext): The shared context containing the REST client and organization name.
 
     Yields:
         Environment (Environment): Deployment environment record.
     """
 
-    full_name = repo.full_name
+    if repo.environment_count == 0:
+        return
+
+    full_name = f"{repo.org_login}/{repo.name}"
     repo_name = repo.name
-    repo_node_id = repo.node_id
+    repo_node_id = repo.id
     client = _client_for_org(ctx, repo.org_login)
     for page in client.paginate(
         f"/repos/{full_name}/environments",
@@ -2334,12 +2341,12 @@ def organization_resources(ctx: SourceContext):
     repo_roles_base = RepositoryRoleCache(ctx)
     repos_resource = repositories(ctx)
     workflows_resource = repos_resource | workflows(ctx)
-    environments_resource = repos_resource | environments(ctx)
     personal_access_tokens_resource = personal_access_tokens(ctx)
 
     teams_resource = teams(ctx)
     team_external_groups_resource = team_external_groups(ctx)
     repositories_graphql_resource = repositories_graphql(ctx)
+    environments_resource = repositories_graphql_resource | environments(ctx)
     app_installs_resource = app_installations(ctx)
     runner_groups_resource = runner_groups(ctx)
     runner_group_access_resource = runner_groups_resource | org_runner_group_access(ctx)

{openhound_github-0.11.0 → openhound_github-0.12.0}/src/openhound_github/transforms.py

@@ -20,7 +20,9 @@ def ensure_optional_input_tables(
         );
         CREATE TABLE IF NOT EXISTS {schema}.repositories_graphql (
             id VARCHAR,
-            branch_ruleset_count BIGINT
+            branch_ruleset_count BIGINT,
+            branch_count BIGINT,
+            environment_count BIGINT
         );
         CREATE TABLE IF NOT EXISTS {schema}.branch_protection_rules (
             id VARCHAR,
@@ -198,6 +200,10 @@ def ensure_optional_input_tables(
             ADD COLUMN IF NOT EXISTS id VARCHAR;
         ALTER TABLE {schema}.repositories_graphql
             ADD COLUMN IF NOT EXISTS branch_ruleset_count BIGINT;
+        ALTER TABLE {schema}.repositories_graphql
+            ADD COLUMN IF NOT EXISTS branch_count BIGINT;
+        ALTER TABLE {schema}.repositories_graphql
+            ADD COLUMN IF NOT EXISTS environment_count BIGINT;
 
         ALTER TABLE {schema}.branch_protection_rules
             ADD COLUMN IF NOT EXISTS id VARCHAR;

{openhound_github-0.11.0 → openhound_github-0.12.0}/tests/test_environment_resources.py

@@ -5,6 +5,7 @@ import pytest
 from openhound_github.resources.organization import (
     OrgContext,
     SourceContext,
+    environments,
     environment_branch_policies,
     environment_secrets,
     environment_variables,
@@ -41,6 +42,41 @@ def _environment(name: str) -> SimpleNamespace:
     )
 
 
+def _repository(environment_count: int | None) -> SimpleNamespace:
+    return SimpleNamespace(
+        id="REPO_1",
+        name="repo",
+        org_login="acme",
+        environment_count=environment_count,
+    )
+
+
+@pytest.mark.parametrize("environment_count", [1, None])
+def test_environments_queries_when_repository_may_have_environments(
+    environment_count: int | None,
+) -> None:
+    client = _FakeClient()
+
+    rows = list(environments.__wrapped__(_repository(environment_count), _ctx(client)))
+
+    assert rows == []
+    assert client.paginate_calls == [
+        (
+            "/repos/acme/repo/environments",
+            {"params": {"per_page": 100}, "data_selector": "environments"},
+        )
+    ]
+
+
+def test_environments_skips_query_when_repository_has_no_environments() -> None:
+    client = _FakeClient()
+
+    rows = list(environments.__wrapped__(_repository(0), _ctx(client)))
+
+    assert rows == []
+    assert client.paginate_calls == []
+
+
 @pytest.mark.parametrize(
     ("transformer", "suffix"),
     [

{openhound_github-0.11.0 → openhound_github-0.12.0}/tests/test_repository_rulesets.py

@@ -38,6 +38,8 @@ def _repository_page_data(
     repository_name: str,
     *,
     branch_ruleset_count: int | None = None,
+    branch_count: int | None = None,
+    environment_count: int | None = None,
     repository_end_cursor: str | None = None,
     repositories_has_next_page: bool = False,
 ) -> dict:
@@ -54,12 +56,14 @@ def _repository_page_data(
                         "name": repository_name,
                         "branchRulesets": {"totalCount": branch_ruleset_count},
                         "refs": {
+                            "totalCount": branch_count,
                             "nodes": [],
                             "pageInfo": {
                                 "endCursor": None,
                                 "hasNextPage": False,
                             },
                         },
+                        "environments": {"totalCount": environment_count},
                     }
                 ]
             }
@@ -122,8 +126,18 @@ def _make_repository() -> Repository:
     )
 
 
-def test_repositories_graphql_flattens_branch_ruleset_count() -> None:
-    client = _FakeClient()
+def test_repositories_graphql_flattens_repository_counts() -> None:
+    client = _FakeClient(
+        _graphql_response(
+            _repository_page_data(
+                "R_1",
+                "repo",
+                branch_ruleset_count=2,
+                branch_count=7,
+                environment_count=3,
+            )
+        )
+    )
     ctx = SourceContext(
         client=client,
         organizations=[OrgContext(client=client, org_name="org")],
@@ -136,10 +150,13 @@ def test_repositories_graphql_flattens_branch_ruleset_count() -> None:
             "id": "R_1",
             "name": "repo",
             "refs": {
+                "totalCount": 7,
                 "nodes": [],
                 "pageInfo": {"endCursor": None, "hasNextPage": False},
             },
             "branch_ruleset_count": 2,
+            "branch_count": 7,
+            "environment_count": 3,
             "org_login": "org",
         }
     ]
@@ -390,6 +407,7 @@ def test_repository_node_surfaces_branch_ruleset_presence() -> None:
     lookup = MagicMock()
     lookup.org_id_for_login.return_value = "O_1"
     lookup.repository_branch_ruleset_count.return_value = 2
+    lookup.repository_graphql_counts.return_value = (7, 3)
     lookup.repository_workflow_permissions.return_value = ("read", False)
     repo._lookup = lookup
 
@@ -397,10 +415,13 @@ def test_repository_node_surfaces_branch_ruleset_presence() -> None:
 
     assert node.properties.branch_ruleset_count == 2
     assert node.properties.has_branch_rulesets is True
+    assert node.properties.branch_count == 7
+    assert node.properties.environment_count == 3
     assert node.properties.default_workflow_permissions == "read"
     assert node.properties.can_approve_pull_request_reviews is False
     assert node.properties.size == 0
     lookup.repository_branch_ruleset_count.assert_called_once_with("R_1")
+    lookup.repository_graphql_counts.assert_called_once_with("R_1")
     lookup.repository_workflow_permissions.assert_called_once_with("R_1")
 
 
@@ -409,6 +430,7 @@ def test_repository_node_preserves_unknown_branch_ruleset_presence() -> None:
     lookup = MagicMock()
     lookup.org_id_for_login.return_value = "O_1"
     lookup.repository_branch_ruleset_count.return_value = None
+    lookup.repository_graphql_counts.return_value = (None, None)
     lookup.repository_workflow_permissions.return_value = None
     repo._lookup = lookup
 
@@ -416,6 +438,8 @@ def test_repository_node_preserves_unknown_branch_ruleset_presence() -> None:
 
     assert node.properties.branch_ruleset_count is None
     assert node.properties.has_branch_rulesets is None
+    assert node.properties.branch_count is None
+    assert node.properties.environment_count is None
     assert node.properties.default_workflow_permissions is None
     assert node.properties.can_approve_pull_request_reviews is None
 
@@ -436,6 +460,23 @@ def test_repository_branch_ruleset_count_lookup_returns_int() -> None:
     assert lookup.repository_branch_ruleset_count("R_2") is None
 
 
+def test_repository_graphql_counts_lookup_returns_ints() -> None:
+    connection = duckdb.connect(":memory:")
+    connection.execute("CREATE SCHEMA github")
+    connection.execute(
+        "CREATE TABLE github.repositories_graphql (id VARCHAR, branch_count BIGINT, environment_count BIGINT)"
+    )
+    connection.execute(
+        "INSERT INTO github.repositories_graphql VALUES ('R_1', 7, 3), ('R_2', NULL, NULL)"
+    )
+
+    lookup = GithubLookup(connection)
+
+    assert lookup.repository_graphql_counts("R_1") == (7, 3)
+    assert lookup.repository_graphql_counts("R_2") == (None, None)
+    assert lookup.repository_graphql_counts("R_3") == (None, None)
+
+
 def test_repository_workflow_permissions_lookup_returns_collected_policy() -> None:
     connection = duckdb.connect(":memory:")
     connection.execute("CREATE SCHEMA github")