openhound-github 0.11.0__tar.gz → 0.13.0__tar.gz

{openhound_github-0.11.0 → openhound_github-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.11.0
+Version: 0.13.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -80,6 +80,7 @@ The collector runs successfully with the documented read-only permission set. So
 
 - Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
 - Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+- Repository `Administration: read` enables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emits `GH_DeployKey` nodes only when that endpoint is accessible.
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 

{openhound_github-0.11.0 → openhound_github-0.13.0}/README.md

@@ -69,6 +69,7 @@ The collector runs successfully with the documented read-only permission set. So
 
 - Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
 - Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+- Repository `Administration: read` enables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emits `GH_DeployKey` nodes only when that endpoint is accessible.
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 

openhound_github-0.13.0/descriptions/edges/GH_AddedDeployKey.md

@@ -0,0 +1,20 @@
+# GH_AddedDeployKey
+
+## General Information
+
+User added this repository deploy key.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_User` | `GH_DeployKey` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_User"]
+    n1["GH_DeployKey"]
+    n0 -.->|GH_AddedDeployKey| n1
+```

openhound_github-0.13.0/descriptions/edges/GH_CanAccess.md

@@ -0,0 +1,29 @@
+# GH_CanAccess
+
+## General Information
+
+The non-traversable GH_CanAccess edge indicates that a personal access token, app installation, or deploy key has been granted access to a repository or organization. This edge represents the scope of access granted to a non-human credential rather than a direct attack path, providing visibility into which repositories are reachable through that credential. It is non-traversable because credential access does not transitively extend to other principals.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_AppInstallation` | `GH_Repository` | `false` |
+| `GH_DeployKey` | `GH_Repository` | `false` |
+| `GH_PersonalAccessToken` | `GH_Organization` | `false` |
+| `GH_PersonalAccessToken` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_AppInstallation"]
+    n1["GH_Repository"]
+    n2["GH_DeployKey"]
+    n3["GH_PersonalAccessToken"]
+    n4["GH_Organization"]
+    n0 -.->|GH_CanAccess| n1
+    n2 -.->|GH_CanAccess| n1
+    n3 -.->|GH_CanAccess| n4
+    n3 -.->|GH_CanAccess| n1
+```

{openhound_github-0.11.0 → openhound_github-0.13.0}/descriptions/edges/GH_Contains.md

@@ -27,6 +27,7 @@ The non-traversable GH_Contains edge represents structural containment within th
 | `GH_Organization` | `GH_SecretScanningAlert` | `false` |
 | `GH_Repository` | `GH_Branch` | `false` |
 | `GH_Repository` | `GH_BranchProtectionRule` | `false` |
+| `GH_Repository` | `GH_DeployKey` | `false` |
 | `GH_Repository` | `GH_Environment` | `false` |
 | `GH_Repository` | `GH_RepoRunner` | `false` |
 | `GH_Repository` | `GH_RepoSecret` | `false` |
@@ -62,12 +63,13 @@ graph LR
     n19["GH_Repository"]
     n20["GH_Branch"]
     n21["GH_BranchProtectionRule"]
-    n22["GH_RepoRunner"]
-    n23["GH_RepoSecret"]
-    n24["GH_RepoVariable"]
-    n25["GH_Workflow"]
-    n26["GH_WorkflowJob"]
-    n27["GH_WorkflowStep"]
+    n22["GH_DeployKey"]
+    n23["GH_RepoRunner"]
+    n24["GH_RepoSecret"]
+    n25["GH_RepoVariable"]
+    n26["GH_Workflow"]
+    n27["GH_WorkflowJob"]
+    n28["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n0 -.->|GH_Contains| n2
     n0 -.->|GH_Contains| n3
@@ -87,12 +89,13 @@ graph LR
     n4 -.->|GH_Contains| n18
     n19 -.->|GH_Contains| n20
     n19 -.->|GH_Contains| n21
-    n19 -.->|GH_Contains| n6
     n19 -.->|GH_Contains| n22
+    n19 -.->|GH_Contains| n6
     n19 -.->|GH_Contains| n23
     n19 -.->|GH_Contains| n24
-    n19 -.->|GH_Contains| n18
     n19 -.->|GH_Contains| n25
-    n25 -.->|GH_Contains| n26
+    n19 -.->|GH_Contains| n18
+    n19 -.->|GH_Contains| n26
     n26 -.->|GH_Contains| n27
+    n27 -.->|GH_Contains| n28
 ```

openhound_github-0.13.0/descriptions/nodes/GH_DeployKey.md

@@ -0,0 +1,43 @@
+# GH_DeployKey
+
+## General Information
+
+A repository-scoped SSH deploy key that grants read-only or read-write access to repository contents.
+
+## Properties
+
+| Property | Type | Description |
+| --- | --- | --- |
+| `name` | `string` | The node name used for matching and display. |
+| `displayname` | `string` | The human-readable display name. |
+| `environmentid` | `string` | The identifier of the GitHub environment where this node was collected. |
+| `last_seen` | `datetime` | The timestamp when this node was last observed during collection. |
+| `node_id` | `string` | The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available. |
+| `github_id` | `integer` | The numeric GitHub deploy key ID. |
+| `title` | `string` | The user-assigned deploy key title. |
+| `key` | `string` | The public SSH key material. |
+| `verified` | `boolean` | Whether GitHub has verified the deploy key. |
+| `enabled` | `boolean` | Whether the deploy key is currently enabled. |
+| `read_only` | `boolean` | Whether the deploy key is restricted to read-only repository access. |
+| `repository_permissions` | `list[string]` | Repository-scoped permissions in `scope:access` form. |
+| `created_at` | `string` | When the deploy key was created. |
+| `last_used` | `string` | When the deploy key was last used. |
+| `added_by_login` | `string` | The login of the user who added the deploy key. |
+| `added_by_id` | `string` | The node ID of the user who added the deploy key. |
+| `repository_name` | `string` | The full name of the containing repository. |
+| `repository_id` | `string` | The node_id of the containing repository. |
+| `environment_name` | `string` | The name of the environment (GitHub organization). |
+| `query_repository` | `string` | Query for the containing repository. |
+| `query_added_by` | `string` | Query for the user who added the deploy key. |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_DeployKey"]
+    n1["GH_Repository"]
+    n2["GH_User"]
+    n0 -.->|GH_CanAccess| n1
+    n1 -.->|GH_Contains| n0
+    n2 -.->|GH_AddedDeployKey| n0
+```

{openhound_github-0.11.0 → openhound_github-0.13.0}/descriptions/nodes/GH_Environment.md

@@ -59,5 +59,4 @@ graph LR
     n8 -.->|GH_ApprovesDeploymentTo| n1
     n8 -->|GH_CanDeployToEnvironment| n1
     n9 -.->|GH_DeploysTo| n1
-    n9 -->|GH_CanRequestOIDCTokenFor| n1
 ```

{openhound_github-0.11.0 → openhound_github-0.13.0}/descriptions/nodes/GH_Repository.md

@@ -6,6 +6,8 @@ Represents a GitHub repository within the organization. Repository nodes capture
 
 For repositories with active workflows, the collector records the applicable default workflow permissions and whether workflows may approve pull request reviews. These properties preserve the repository-level policy input later used to derive effective GITHUB_TOKEN permissions for GH_WorkflowJob nodes.
 
+The `branch_count` and `environment_count` properties preserve GitHub-reported totals from the repository GraphQL response. These values can be compared to collected GH_Branch and GH_Environment children to identify incomplete collection before relying on branch- or environment-dependent analysis.
+
 ## Properties
 
 | Property | Type | Description |
@@ -44,6 +46,9 @@ For repositories with active workflows, the collector records the applicable def
 | `secret_scanning` | `string` | Status of secret scanning (e.g., `enabled`, `disabled`). |
 | `branch_ruleset_count` | `integer` | Number of branch-targeted rulesets that apply to this repository. |
 | `has_branch_rulesets` | `boolean` | Whether at least one branch-targeted ruleset applies to this repository. |
+| `branch_count` | `integer` | Number of branch refs reported by GitHub for this repository. |
+| `environment_count` | `integer` | Number of deployment environments reported by GitHub for this repository. |
+| `deploy_key_count` | `integer` | Number of deploy keys reported by GitHub for this repository. |
 | `query_branches` | `string` | Query for branches. |
 | `query_protected_branches` | `string` | Query for protected branches. |
 | `query_branch_protection_rules` | `string` | Query for branch protection rules. |
@@ -54,6 +59,7 @@ For repositories with active workflows, the collector records the applicable def
 | `query_environments` | `string` | Query for environments. |
 | `query_secrets` | `string` | Query for secrets. |
 | `query_variables` | `string` | Query for variables. |
+| `query_deploy_keys` | `string` | Query for deploy keys. |
 | `query_secret_scanning_alerts` | `string` | Query for secret scanning alerts. |
 | `query_explicit_readers` | `string` | Query for explicit readers. |
 | `query_unrolled_readers` | `string` | Query for unrolled readers. |
@@ -66,98 +72,101 @@ For repositories with active workflows, the collector records the applicable def
 graph LR
     n0["GH_AppInstallation"]
     n1["GH_Repository"]
-    n2["GH_Organization"]
-    n3["GH_PersonalAccessToken"]
-    n4["GH_RepoRole"]
-    n5["GH_Branch"]
-    n6["GH_BranchProtectionRule"]
-    n7["GH_Environment"]
-    n8["GH_OrgRunnerGroup"]
-    n9["GH_OrgSecret"]
-    n10["GH_OrgVariable"]
-    n11["GH_RepoRunner"]
-    n12["GH_RepoSecret"]
-    n13["GH_RepoVariable"]
-    n14["GH_SecretScanningAlert"]
-    n15["GH_Workflow"]
+    n2["GH_DeployKey"]
+    n3["GH_Organization"]
+    n4["GH_PersonalAccessToken"]
+    n5["GH_RepoRole"]
+    n6["GH_Branch"]
+    n7["GH_BranchProtectionRule"]
+    n8["GH_Environment"]
+    n9["GH_OrgRunnerGroup"]
+    n10["GH_OrgSecret"]
+    n11["GH_OrgVariable"]
+    n12["GH_RepoRunner"]
+    n13["GH_RepoSecret"]
+    n14["GH_RepoVariable"]
+    n15["GH_SecretScanningAlert"]
+    n16["GH_Workflow"]
     n0 -.->|GH_CanAccess| n1
-    n2 -->|GH_Owns| n1
-    n3 -.->|GH_CanAccess| n1
-    n4 -.->|GH_AddAssignee| n1
-    n4 -.->|GH_AddLabel| n1
-    n4 -->|GH_AdminTo| n1
-    n4 -.->|GH_BypassBranchProtection| n1
-    n4 -.->|GH_CanCreateBranch| n1
-    n4 -->|GH_CanCreateEnvironment| n1
-    n4 -->|GH_CanPwnRequest| n1
-    n4 -.->|GH_CloseDiscussion| n1
-    n4 -.->|GH_CloseIssue| n1
-    n4 -.->|GH_ClosePullRequest| n1
-    n4 -.->|GH_ConvertIssuesToDiscussions| n1
-    n4 -.->|GH_CreateDiscussionCategory| n1
-    n4 -.->|GH_CreateSoloMergeQueueEntry| n1
-    n4 -.->|GH_CreateTag| n1
-    n4 -.->|GH_DeleteAlertsCodeScanning| n1
-    n4 -.->|GH_DeleteDiscussion| n1
-    n4 -.->|GH_DeleteDiscussionComment| n1
-    n4 -.->|GH_DeleteIssue| n1
-    n4 -.->|GH_DeleteTag| n1
-    n4 -.->|GH_EditCategoryOnDiscussion| n1
-    n4 -.->|GH_EditDiscussionCategory| n1
-    n4 -.->|GH_EditDiscussionComment| n1
-    n4 -.->|GH_EditRepoAnnouncementBanners| n1
-    n4 -.->|GH_EditRepoCustomPropertiesValues| n1
-    n4 -.->|GH_EditRepoMetadata| n1
-    n4 -.->|GH_EditRepoProtections| n1
-    n4 -.->|GH_JumpMergeQueue| n1
-    n4 -.->|GH_ManageDeployKeys| n1
-    n4 -.->|GH_ManageDiscussionBadges| n1
-    n4 -.->|GH_ManageRepoSecurityProducts| n1
-    n4 -.->|GH_ManageSecurityProducts| n1
-    n4 -.->|GH_ManageSettingsMergeTypes| n1
-    n4 -.->|GH_ManageSettingsPages| n1
-    n4 -.->|GH_ManageSettingsProjects| n1
-    n4 -.->|GH_ManageSettingsWiki| n1
-    n4 -.->|GH_ManageTopics| n1
-    n4 -.->|GH_ManageWebhooks| n1
-    n4 -.->|GH_MarkAsDuplicate| n1
-    n4 -.->|GH_PushProtectedBranch| n1
-    n4 -.->|GH_ReadCodeScanning| n1
-    n4 -.->|GH_ReadRepoContents| n1
-    n4 -.->|GH_RemoveAssignee| n1
-    n4 -.->|GH_RemoveLabel| n1
-    n4 -.->|GH_ReopenDiscussion| n1
-    n4 -.->|GH_ReopenIssue| n1
-    n4 -.->|GH_ReopenPullRequest| n1
-    n4 -.->|GH_RequestPrReview| n1
-    n4 -.->|GH_ResolveDependabotAlerts| n1
-    n4 -.->|GH_ResolveSecretScanningAlerts| n1
-    n4 -.->|GH_RunOrgMigration| n1
-    n4 -.->|GH_SetInteractionLimits| n1
-    n4 -.->|GH_SetIssueType| n1
-    n4 -.->|GH_SetMilestone| n1
-    n4 -.->|GH_SetSocialPreview| n1
-    n4 -.->|GH_ToggleDiscussionAnswer| n1
-    n4 -.->|GH_ToggleDiscussionCommentMinimize| n1
-    n4 -.->|GH_ViewDependabotAlerts| n1
-    n4 -.->|GH_ViewSecretScanningAlerts| n1
-    n4 -.->|GH_WriteCodeScanning| n1
-    n4 -.->|GH_WriteRepoContents| n1
-    n4 -.->|GH_WriteRepoPullRequests| n1
-    n1 -.->|GH_Contains| n5
+    n2 -.->|GH_CanAccess| n1
+    n3 -->|GH_Owns| n1
+    n4 -.->|GH_CanAccess| n1
+    n5 -.->|GH_AddAssignee| n1
+    n5 -.->|GH_AddLabel| n1
+    n5 -->|GH_AdminTo| n1
+    n5 -.->|GH_BypassBranchProtection| n1
+    n5 -.->|GH_CanCreateBranch| n1
+    n5 -->|GH_CanCreateEnvironment| n1
+    n5 -->|GH_CanPwnRequest| n1
+    n5 -.->|GH_CloseDiscussion| n1
+    n5 -.->|GH_CloseIssue| n1
+    n5 -.->|GH_ClosePullRequest| n1
+    n5 -.->|GH_ConvertIssuesToDiscussions| n1
+    n5 -.->|GH_CreateDiscussionCategory| n1
+    n5 -.->|GH_CreateSoloMergeQueueEntry| n1
+    n5 -.->|GH_CreateTag| n1
+    n5 -.->|GH_DeleteAlertsCodeScanning| n1
+    n5 -.->|GH_DeleteDiscussion| n1
+    n5 -.->|GH_DeleteDiscussionComment| n1
+    n5 -.->|GH_DeleteIssue| n1
+    n5 -.->|GH_DeleteTag| n1
+    n5 -.->|GH_EditCategoryOnDiscussion| n1
+    n5 -.->|GH_EditDiscussionCategory| n1
+    n5 -.->|GH_EditDiscussionComment| n1
+    n5 -.->|GH_EditRepoAnnouncementBanners| n1
+    n5 -.->|GH_EditRepoCustomPropertiesValues| n1
+    n5 -.->|GH_EditRepoMetadata| n1
+    n5 -.->|GH_EditRepoProtections| n1
+    n5 -.->|GH_JumpMergeQueue| n1
+    n5 -.->|GH_ManageDeployKeys| n1
+    n5 -.->|GH_ManageDiscussionBadges| n1
+    n5 -.->|GH_ManageRepoSecurityProducts| n1
+    n5 -.->|GH_ManageSecurityProducts| n1
+    n5 -.->|GH_ManageSettingsMergeTypes| n1
+    n5 -.->|GH_ManageSettingsPages| n1
+    n5 -.->|GH_ManageSettingsProjects| n1
+    n5 -.->|GH_ManageSettingsWiki| n1
+    n5 -.->|GH_ManageTopics| n1
+    n5 -.->|GH_ManageWebhooks| n1
+    n5 -.->|GH_MarkAsDuplicate| n1
+    n5 -.->|GH_PushProtectedBranch| n1
+    n5 -.->|GH_ReadCodeScanning| n1
+    n5 -.->|GH_ReadRepoContents| n1
+    n5 -.->|GH_RemoveAssignee| n1
+    n5 -.->|GH_RemoveLabel| n1
+    n5 -.->|GH_ReopenDiscussion| n1
+    n5 -.->|GH_ReopenIssue| n1
+    n5 -.->|GH_ReopenPullRequest| n1
+    n5 -.->|GH_RequestPrReview| n1
+    n5 -.->|GH_ResolveDependabotAlerts| n1
+    n5 -.->|GH_ResolveSecretScanningAlerts| n1
+    n5 -.->|GH_RunOrgMigration| n1
+    n5 -.->|GH_SetInteractionLimits| n1
+    n5 -.->|GH_SetIssueType| n1
+    n5 -.->|GH_SetMilestone| n1
+    n5 -.->|GH_SetSocialPreview| n1
+    n5 -.->|GH_ToggleDiscussionAnswer| n1
+    n5 -.->|GH_ToggleDiscussionCommentMinimize| n1
+    n5 -.->|GH_ViewDependabotAlerts| n1
+    n5 -.->|GH_ViewSecretScanningAlerts| n1
+    n5 -.->|GH_WriteCodeScanning| n1
+    n5 -.->|GH_WriteRepoContents| n1
+    n5 -.->|GH_WriteRepoPullRequests| n1
     n1 -.->|GH_Contains| n6
-    n1 -->|GH_CanDeployToEnvironment| n7
     n1 -.->|GH_Contains| n7
-    n1 -->|GH_CanUseRunner| n8
-    n1 -.->|GH_IsEligibleFor| n8
-    n1 -->|GH_HasSecret| n9
-    n1 -->|GH_HasVariable| n10
-    n1 -.->|GH_CanUseRunner| n11
-    n1 -.->|GH_Contains| n11
+    n1 -.->|GH_Contains| n2
+    n1 -->|GH_CanDeployToEnvironment| n8
+    n1 -.->|GH_Contains| n8
+    n1 -->|GH_CanUseRunner| n9
+    n1 -.->|GH_IsEligibleFor| n9
+    n1 -->|GH_HasSecret| n10
+    n1 -->|GH_HasVariable| n11
+    n1 -.->|GH_CanUseRunner| n12
     n1 -.->|GH_Contains| n12
-    n1 -->|GH_HasSecret| n12
     n1 -.->|GH_Contains| n13
-    n1 -->|GH_HasVariable| n13
+    n1 -->|GH_HasSecret| n13
     n1 -.->|GH_Contains| n14
+    n1 -->|GH_HasVariable| n14
     n1 -.->|GH_Contains| n15
+    n1 -.->|GH_Contains| n16
 ```

{openhound_github-0.11.0 → openhound_github-0.13.0}/descriptions/nodes/GH_User.md

@@ -36,13 +36,14 @@ graph LR
     n4["GH_SecretScanningAlert"]
     n5["GH_Branch"]
     n6["GH_BranchProtectionRule"]
-    n7["GH_EnterpriseRole"]
-    n8["GH_Environment"]
-    n9["GH_OrgRole"]
-    n10["GH_PersonalAccessToken"]
-    n11["GH_PersonalAccessTokenRequest"]
-    n12["GH_RepoRole"]
-    n13["GH_TeamRole"]
+    n7["GH_DeployKey"]
+    n8["GH_EnterpriseRole"]
+    n9["GH_Environment"]
+    n10["GH_OrgRole"]
+    n11["GH_PersonalAccessToken"]
+    n12["GH_PersonalAccessTokenRequest"]
+    n13["GH_RepoRole"]
+    n14["GH_TeamRole"]
     n0 -.->|GH_HasMember| n1
     n2 -.->|GH_MapsToUser| n1
     n3 -.->|GH_MapsToUser| n1
@@ -50,12 +51,13 @@ graph LR
     n1 -.->|GH_CanWriteBranch| n5
     n1 -.->|GH_BypassPullRequestAllowances| n6
     n1 -.->|GH_RestrictionsCanPush| n6
-    n1 -->|GH_HasRole| n7
-    n1 -.->|GH_ApprovesDeploymentTo| n8
-    n1 -->|GH_CanDeployToEnvironment| n8
-    n1 -->|GH_HasRole| n9
-    n1 -.->|GH_HasPersonalAccessToken| n10
-    n1 -.->|GH_HasPersonalAccessTokenRequest| n11
-    n1 -->|GH_HasRole| n12
+    n1 -.->|GH_AddedDeployKey| n7
+    n1 -->|GH_HasRole| n8
+    n1 -.->|GH_ApprovesDeploymentTo| n9
+    n1 -->|GH_CanDeployToEnvironment| n9
+    n1 -->|GH_HasRole| n10
+    n1 -.->|GH_HasPersonalAccessToken| n11
+    n1 -.->|GH_HasPersonalAccessTokenRequest| n12
     n1 -->|GH_HasRole| n13
+    n1 -->|GH_HasRole| n14
 ```

{openhound_github-0.11.0 → openhound_github-0.13.0}/extension/schema.json

@@ -190,6 +190,14 @@
       "icon": "lock-open",
       "color": "#66C7E8"
     },
+    {
+      "name": "GH_DeployKey",
+      "display_name": "GitHub Deploy Key",
+      "description": "A repository-scoped SSH deploy key that grants read-only or read-write access to repository contents",
+      "is_display_kind": true,
+      "icon": "key",
+      "color": "#F9C74F"
+    },
     {
       "name": "GH_Secret",
       "display_name": "GitHub Secret",
@@ -325,6 +333,11 @@
       "description": "Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)",
       "is_traversable": false
     },
+    {
+      "name": "GH_AddedDeployKey",
+      "description": "User added this repository deploy key",
+      "is_traversable": false
+    },
     {
       "name": "GH_CreateEnterpriseOrganizations",
       "description": "[Enterprise] Enterprise role can create organizations",
@@ -962,7 +975,7 @@
     },
     {
       "name": "GH_CanAccess",
-      "description": "Personal access token or app installation can access this repository or organization",
+      "description": "Personal access token, app installation, or deploy key can access this repository or organization",
       "is_traversable": false
     },
     {

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/graphql.py

@@ -271,6 +271,7 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     totalCount
                 }
                 refs(first: 100, refPrefix: "refs/heads/") {
+                    totalCount
                     nodes {
                         id
                         name
@@ -279,6 +280,12 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                     }
                     pageInfo { endCursor hasNextPage }
                 }
+                environments(first: 1) {
+                    totalCount
+                }
+                deployKeys(first: 1) {
+                    totalCount
+                }
             }
             pageInfo { endCursor hasNextPage }
         }

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/kinds/edges.py

@@ -87,6 +87,7 @@ HAS_PERSONAL_ACCESS_TOKEN_REQUEST = "GH_HasPersonalAccessTokenRequest"
 # Secret and variable edges
 HAS_SECRET = "GH_HasSecret"
 HAS_VARIABLE = "GH_HasVariable"
+ADDED_DEPLOY_KEY = "GH_AddedDeployKey"
 
 # App installation edges
 INSTALLED_AS = "GH_InstalledAs"

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/kinds/nodes.py

@@ -33,6 +33,7 @@ REPO_ROLE = "GH_RepoRole"
 REPO_SECRET = "GH_RepoSecret"
 REPO_VARIABLE = "GH_RepoVariable"
 REPO_RUNNER = "GH_RepoRunner"
+DEPLOY_KEY = "GH_DeployKey"
 
 DEFAULT_ROLE = "GH_RepoRole"
 

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/lookup.py

@@ -54,6 +54,35 @@ class GithubLookup(LookupManager):
             [org_login],
         )
 
+    @lru_cache
+    def user_node_id_for_login(self, org_login: str, user_login: str) -> str | None:
+        return self._find_single_object(
+            f"""
+            WITH candidate_users AS (
+                SELECT 0 AS priority, u.id
+                FROM {self.schema}.users u
+                WHERE lower(u.org_login) = lower(?)
+                  AND lower(u.login) = lower(?)
+
+                UNION ALL
+
+                SELECT 1 AS priority, eu.id
+                FROM {self.schema}.enterprise_users eu
+                JOIN {self.schema}.enterprise e
+                  ON lower(e.slug) = lower(eu.enterprise_slug)
+                JOIN {self.schema}.enterprise_organizations eo
+                  ON eo.enterprise_node_id = e.id
+                WHERE lower(eo.login) = lower(?)
+                  AND lower(eu.login) = lower(?)
+            )
+            SELECT id
+            FROM candidate_users
+            ORDER BY priority
+            LIMIT 1
+            """,
+            [org_login, user_login, org_login, user_login],
+        )
+
     @lru_cache
     def org_login(self) -> str | None:
         res = self._find_single_object(
@@ -602,6 +631,26 @@ class GithubLookup(LookupManager):
             return None
         return int(row[0])
 
+    @lru_cache
+    def repository_graphql_counts(
+        self, repository_node_id: str
+    ) -> tuple[int | None, int | None, int | None]:
+        row = self._find_single_row(
+            f"""
+            SELECT branch_count, environment_count, deploy_key_count
+            FROM {self.schema}.repositories_graphql
+            WHERE id = ?
+            """,
+            [repository_node_id],
+        )
+        if row is None:
+            return None, None, None
+        return (
+            None if row[0] is None else int(row[0]),
+            None if row[1] is None else int(row[1]),
+            None if row[2] is None else int(row[2]),
+        )
+
     @lru_cache
     def repository_workflow_permissions(
         self, repository_node_id: str

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/main.py

@@ -67,6 +67,7 @@ def preproc(ctx: PreProcContext):
         "external_identities": "external_identities",
         "applications": "applications",
         "enterprise": "enterprise",
+        "enterprise_users": "enterprise_users",
         "enterprise_organizations": "enterprise_organizations",
         "enterprise_scim_groups": "enterprise_scim_groups",
         "enterprise_runner_groups": "enterprise_runner_groups",

{openhound_github-0.11.0 → openhound_github-0.13.0}/src/openhound_github/models/__init__.py

@@ -22,6 +22,7 @@ from .env_secret import EnvironmentSecret
 from .env_variable import EnvironmentVariable
 from .environment import Environment
 from .environment_branch_policy import EnvironmentBranchPolicy
+from .deploy_key import DeployKey
 from .external_identity import ExternalIdentity
 from .org import Organization
 from .org_role import OrgRole
@@ -132,6 +133,7 @@ __all__ = [
     "EnvironmentSecret",
     "EnvironmentVariable",
     "EnvironmentBranchPolicy",
+    "DeployKey",
     "Enterprise",
     "EnterpriseAdmin",
     "EnterpriseManagedUser",