openhound-github 0.12.0__tar.gz → 0.13.0__tar.gz

{openhound_github-0.12.0 → openhound_github-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.12.0
+Version: 0.13.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -80,6 +80,7 @@ The collector runs successfully with the documented read-only permission set. So
 
 - Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
 - Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+- Repository `Administration: read` enables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emits `GH_DeployKey` nodes only when that endpoint is accessible.
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 

{openhound_github-0.12.0 → openhound_github-0.13.0}/README.md

@@ -69,6 +69,7 @@ The collector runs successfully with the documented read-only permission set. So
 
 - Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
 - Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+- Repository `Administration: read` enables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emits `GH_DeployKey` nodes only when that endpoint is accessible.
 
 If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
 

openhound_github-0.13.0/descriptions/edges/GH_AddedDeployKey.md

@@ -0,0 +1,20 @@
+# GH_AddedDeployKey
+
+## General Information
+
+User added this repository deploy key.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_User` | `GH_DeployKey` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_User"]
+    n1["GH_DeployKey"]
+    n0 -.->|GH_AddedDeployKey| n1
+```

openhound_github-0.13.0/descriptions/edges/GH_CanAccess.md

@@ -0,0 +1,29 @@
+# GH_CanAccess
+
+## General Information
+
+The non-traversable GH_CanAccess edge indicates that a personal access token, app installation, or deploy key has been granted access to a repository or organization. This edge represents the scope of access granted to a non-human credential rather than a direct attack path, providing visibility into which repositories are reachable through that credential. It is non-traversable because credential access does not transitively extend to other principals.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_AppInstallation` | `GH_Repository` | `false` |
+| `GH_DeployKey` | `GH_Repository` | `false` |
+| `GH_PersonalAccessToken` | `GH_Organization` | `false` |
+| `GH_PersonalAccessToken` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_AppInstallation"]
+    n1["GH_Repository"]
+    n2["GH_DeployKey"]
+    n3["GH_PersonalAccessToken"]
+    n4["GH_Organization"]
+    n0 -.->|GH_CanAccess| n1
+    n2 -.->|GH_CanAccess| n1
+    n3 -.->|GH_CanAccess| n4
+    n3 -.->|GH_CanAccess| n1
+```

{openhound_github-0.12.0 → openhound_github-0.13.0}/descriptions/edges/GH_Contains.md

@@ -27,6 +27,7 @@ The non-traversable GH_Contains edge represents structural containment within th
 | `GH_Organization` | `GH_SecretScanningAlert` | `false` |
 | `GH_Repository` | `GH_Branch` | `false` |
 | `GH_Repository` | `GH_BranchProtectionRule` | `false` |
+| `GH_Repository` | `GH_DeployKey` | `false` |
 | `GH_Repository` | `GH_Environment` | `false` |
 | `GH_Repository` | `GH_RepoRunner` | `false` |
 | `GH_Repository` | `GH_RepoSecret` | `false` |
@@ -62,12 +63,13 @@ graph LR
     n19["GH_Repository"]
     n20["GH_Branch"]
     n21["GH_BranchProtectionRule"]
-    n22["GH_RepoRunner"]
-    n23["GH_RepoSecret"]
-    n24["GH_RepoVariable"]
-    n25["GH_Workflow"]
-    n26["GH_WorkflowJob"]
-    n27["GH_WorkflowStep"]
+    n22["GH_DeployKey"]
+    n23["GH_RepoRunner"]
+    n24["GH_RepoSecret"]
+    n25["GH_RepoVariable"]
+    n26["GH_Workflow"]
+    n27["GH_WorkflowJob"]
+    n28["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n0 -.->|GH_Contains| n2
     n0 -.->|GH_Contains| n3
@@ -87,12 +89,13 @@ graph LR
     n4 -.->|GH_Contains| n18
     n19 -.->|GH_Contains| n20
     n19 -.->|GH_Contains| n21
-    n19 -.->|GH_Contains| n6
     n19 -.->|GH_Contains| n22
+    n19 -.->|GH_Contains| n6
     n19 -.->|GH_Contains| n23
     n19 -.->|GH_Contains| n24
-    n19 -.->|GH_Contains| n18
     n19 -.->|GH_Contains| n25
-    n25 -.->|GH_Contains| n26
+    n19 -.->|GH_Contains| n18
+    n19 -.->|GH_Contains| n26
     n26 -.->|GH_Contains| n27
+    n27 -.->|GH_Contains| n28
 ```

openhound_github-0.13.0/descriptions/nodes/GH_DeployKey.md

@@ -0,0 +1,43 @@
+# GH_DeployKey
+
+## General Information
+
+A repository-scoped SSH deploy key that grants read-only or read-write access to repository contents.
+
+## Properties
+
+| Property | Type | Description |
+| --- | --- | --- |
+| `name` | `string` | The node name used for matching and display. |
+| `displayname` | `string` | The human-readable display name. |
+| `environmentid` | `string` | The identifier of the GitHub environment where this node was collected. |
+| `last_seen` | `datetime` | The timestamp when this node was last observed during collection. |
+| `node_id` | `string` | The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available. |
+| `github_id` | `integer` | The numeric GitHub deploy key ID. |
+| `title` | `string` | The user-assigned deploy key title. |
+| `key` | `string` | The public SSH key material. |
+| `verified` | `boolean` | Whether GitHub has verified the deploy key. |
+| `enabled` | `boolean` | Whether the deploy key is currently enabled. |
+| `read_only` | `boolean` | Whether the deploy key is restricted to read-only repository access. |
+| `repository_permissions` | `list[string]` | Repository-scoped permissions in `scope:access` form. |
+| `created_at` | `string` | When the deploy key was created. |
+| `last_used` | `string` | When the deploy key was last used. |
+| `added_by_login` | `string` | The login of the user who added the deploy key. |
+| `added_by_id` | `string` | The node ID of the user who added the deploy key. |
+| `repository_name` | `string` | The full name of the containing repository. |
+| `repository_id` | `string` | The node_id of the containing repository. |
+| `environment_name` | `string` | The name of the environment (GitHub organization). |
+| `query_repository` | `string` | Query for the containing repository. |
+| `query_added_by` | `string` | Query for the user who added the deploy key. |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_DeployKey"]
+    n1["GH_Repository"]
+    n2["GH_User"]
+    n0 -.->|GH_CanAccess| n1
+    n1 -.->|GH_Contains| n0
+    n2 -.->|GH_AddedDeployKey| n0
+```

{openhound_github-0.12.0 → openhound_github-0.13.0}/descriptions/nodes/GH_Repository.md

@@ -48,6 +48,7 @@ The `branch_count` and `environment_count` properties preserve GitHub-reported t
 | `has_branch_rulesets` | `boolean` | Whether at least one branch-targeted ruleset applies to this repository. |
 | `branch_count` | `integer` | Number of branch refs reported by GitHub for this repository. |
 | `environment_count` | `integer` | Number of deployment environments reported by GitHub for this repository. |
+| `deploy_key_count` | `integer` | Number of deploy keys reported by GitHub for this repository. |
 | `query_branches` | `string` | Query for branches. |
 | `query_protected_branches` | `string` | Query for protected branches. |
 | `query_branch_protection_rules` | `string` | Query for branch protection rules. |
@@ -58,6 +59,7 @@ The `branch_count` and `environment_count` properties preserve GitHub-reported t
 | `query_environments` | `string` | Query for environments. |
 | `query_secrets` | `string` | Query for secrets. |
 | `query_variables` | `string` | Query for variables. |
+| `query_deploy_keys` | `string` | Query for deploy keys. |
 | `query_secret_scanning_alerts` | `string` | Query for secret scanning alerts. |
 | `query_explicit_readers` | `string` | Query for explicit readers. |
 | `query_unrolled_readers` | `string` | Query for unrolled readers. |
@@ -70,98 +72,101 @@ The `branch_count` and `environment_count` properties preserve GitHub-reported t
 graph LR
     n0["GH_AppInstallation"]
     n1["GH_Repository"]
-    n2["GH_Organization"]
-    n3["GH_PersonalAccessToken"]
-    n4["GH_RepoRole"]
-    n5["GH_Branch"]
-    n6["GH_BranchProtectionRule"]
-    n7["GH_Environment"]
-    n8["GH_OrgRunnerGroup"]
-    n9["GH_OrgSecret"]
-    n10["GH_OrgVariable"]
-    n11["GH_RepoRunner"]
-    n12["GH_RepoSecret"]
-    n13["GH_RepoVariable"]
-    n14["GH_SecretScanningAlert"]
-    n15["GH_Workflow"]
+    n2["GH_DeployKey"]
+    n3["GH_Organization"]
+    n4["GH_PersonalAccessToken"]
+    n5["GH_RepoRole"]
+    n6["GH_Branch"]
+    n7["GH_BranchProtectionRule"]
+    n8["GH_Environment"]
+    n9["GH_OrgRunnerGroup"]
+    n10["GH_OrgSecret"]
+    n11["GH_OrgVariable"]
+    n12["GH_RepoRunner"]
+    n13["GH_RepoSecret"]
+    n14["GH_RepoVariable"]
+    n15["GH_SecretScanningAlert"]
+    n16["GH_Workflow"]
     n0 -.->|GH_CanAccess| n1
-    n2 -->|GH_Owns| n1
-    n3 -.->|GH_CanAccess| n1
-    n4 -.->|GH_AddAssignee| n1
-    n4 -.->|GH_AddLabel| n1
-    n4 -->|GH_AdminTo| n1
-    n4 -.->|GH_BypassBranchProtection| n1
-    n4 -.->|GH_CanCreateBranch| n1
-    n4 -->|GH_CanCreateEnvironment| n1
-    n4 -->|GH_CanPwnRequest| n1
-    n4 -.->|GH_CloseDiscussion| n1
-    n4 -.->|GH_CloseIssue| n1
-    n4 -.->|GH_ClosePullRequest| n1
-    n4 -.->|GH_ConvertIssuesToDiscussions| n1
-    n4 -.->|GH_CreateDiscussionCategory| n1
-    n4 -.->|GH_CreateSoloMergeQueueEntry| n1
-    n4 -.->|GH_CreateTag| n1
-    n4 -.->|GH_DeleteAlertsCodeScanning| n1
-    n4 -.->|GH_DeleteDiscussion| n1
-    n4 -.->|GH_DeleteDiscussionComment| n1
-    n4 -.->|GH_DeleteIssue| n1
-    n4 -.->|GH_DeleteTag| n1
-    n4 -.->|GH_EditCategoryOnDiscussion| n1
-    n4 -.->|GH_EditDiscussionCategory| n1
-    n4 -.->|GH_EditDiscussionComment| n1
-    n4 -.->|GH_EditRepoAnnouncementBanners| n1
-    n4 -.->|GH_EditRepoCustomPropertiesValues| n1
-    n4 -.->|GH_EditRepoMetadata| n1
-    n4 -.->|GH_EditRepoProtections| n1
-    n4 -.->|GH_JumpMergeQueue| n1
-    n4 -.->|GH_ManageDeployKeys| n1
-    n4 -.->|GH_ManageDiscussionBadges| n1
-    n4 -.->|GH_ManageRepoSecurityProducts| n1
-    n4 -.->|GH_ManageSecurityProducts| n1
-    n4 -.->|GH_ManageSettingsMergeTypes| n1
-    n4 -.->|GH_ManageSettingsPages| n1
-    n4 -.->|GH_ManageSettingsProjects| n1
-    n4 -.->|GH_ManageSettingsWiki| n1
-    n4 -.->|GH_ManageTopics| n1
-    n4 -.->|GH_ManageWebhooks| n1
-    n4 -.->|GH_MarkAsDuplicate| n1
-    n4 -.->|GH_PushProtectedBranch| n1
-    n4 -.->|GH_ReadCodeScanning| n1
-    n4 -.->|GH_ReadRepoContents| n1
-    n4 -.->|GH_RemoveAssignee| n1
-    n4 -.->|GH_RemoveLabel| n1
-    n4 -.->|GH_ReopenDiscussion| n1
-    n4 -.->|GH_ReopenIssue| n1
-    n4 -.->|GH_ReopenPullRequest| n1
-    n4 -.->|GH_RequestPrReview| n1
-    n4 -.->|GH_ResolveDependabotAlerts| n1
-    n4 -.->|GH_ResolveSecretScanningAlerts| n1
-    n4 -.->|GH_RunOrgMigration| n1
-    n4 -.->|GH_SetInteractionLimits| n1
-    n4 -.->|GH_SetIssueType| n1
-    n4 -.->|GH_SetMilestone| n1
-    n4 -.->|GH_SetSocialPreview| n1
-    n4 -.->|GH_ToggleDiscussionAnswer| n1
-    n4 -.->|GH_ToggleDiscussionCommentMinimize| n1
-    n4 -.->|GH_ViewDependabotAlerts| n1
-    n4 -.->|GH_ViewSecretScanningAlerts| n1
-    n4 -.->|GH_WriteCodeScanning| n1
-    n4 -.->|GH_WriteRepoContents| n1
-    n4 -.->|GH_WriteRepoPullRequests| n1
-    n1 -.->|GH_Contains| n5
+    n2 -.->|GH_CanAccess| n1
+    n3 -->|GH_Owns| n1
+    n4 -.->|GH_CanAccess| n1
+    n5 -.->|GH_AddAssignee| n1
+    n5 -.->|GH_AddLabel| n1
+    n5 -->|GH_AdminTo| n1
+    n5 -.->|GH_BypassBranchProtection| n1
+    n5 -.->|GH_CanCreateBranch| n1
+    n5 -->|GH_CanCreateEnvironment| n1
+    n5 -->|GH_CanPwnRequest| n1
+    n5 -.->|GH_CloseDiscussion| n1
+    n5 -.->|GH_CloseIssue| n1
+    n5 -.->|GH_ClosePullRequest| n1
+    n5 -.->|GH_ConvertIssuesToDiscussions| n1
+    n5 -.->|GH_CreateDiscussionCategory| n1
+    n5 -.->|GH_CreateSoloMergeQueueEntry| n1
+    n5 -.->|GH_CreateTag| n1
+    n5 -.->|GH_DeleteAlertsCodeScanning| n1
+    n5 -.->|GH_DeleteDiscussion| n1
+    n5 -.->|GH_DeleteDiscussionComment| n1
+    n5 -.->|GH_DeleteIssue| n1
+    n5 -.->|GH_DeleteTag| n1
+    n5 -.->|GH_EditCategoryOnDiscussion| n1
+    n5 -.->|GH_EditDiscussionCategory| n1
+    n5 -.->|GH_EditDiscussionComment| n1
+    n5 -.->|GH_EditRepoAnnouncementBanners| n1
+    n5 -.->|GH_EditRepoCustomPropertiesValues| n1
+    n5 -.->|GH_EditRepoMetadata| n1
+    n5 -.->|GH_EditRepoProtections| n1
+    n5 -.->|GH_JumpMergeQueue| n1
+    n5 -.->|GH_ManageDeployKeys| n1
+    n5 -.->|GH_ManageDiscussionBadges| n1
+    n5 -.->|GH_ManageRepoSecurityProducts| n1
+    n5 -.->|GH_ManageSecurityProducts| n1
+    n5 -.->|GH_ManageSettingsMergeTypes| n1
+    n5 -.->|GH_ManageSettingsPages| n1
+    n5 -.->|GH_ManageSettingsProjects| n1
+    n5 -.->|GH_ManageSettingsWiki| n1
+    n5 -.->|GH_ManageTopics| n1
+    n5 -.->|GH_ManageWebhooks| n1
+    n5 -.->|GH_MarkAsDuplicate| n1
+    n5 -.->|GH_PushProtectedBranch| n1
+    n5 -.->|GH_ReadCodeScanning| n1
+    n5 -.->|GH_ReadRepoContents| n1
+    n5 -.->|GH_RemoveAssignee| n1
+    n5 -.->|GH_RemoveLabel| n1
+    n5 -.->|GH_ReopenDiscussion| n1
+    n5 -.->|GH_ReopenIssue| n1
+    n5 -.->|GH_ReopenPullRequest| n1
+    n5 -.->|GH_RequestPrReview| n1
+    n5 -.->|GH_ResolveDependabotAlerts| n1
+    n5 -.->|GH_ResolveSecretScanningAlerts| n1
+    n5 -.->|GH_RunOrgMigration| n1
+    n5 -.->|GH_SetInteractionLimits| n1
+    n5 -.->|GH_SetIssueType| n1
+    n5 -.->|GH_SetMilestone| n1
+    n5 -.->|GH_SetSocialPreview| n1
+    n5 -.->|GH_ToggleDiscussionAnswer| n1
+    n5 -.->|GH_ToggleDiscussionCommentMinimize| n1
+    n5 -.->|GH_ViewDependabotAlerts| n1
+    n5 -.->|GH_ViewSecretScanningAlerts| n1
+    n5 -.->|GH_WriteCodeScanning| n1
+    n5 -.->|GH_WriteRepoContents| n1
+    n5 -.->|GH_WriteRepoPullRequests| n1
     n1 -.->|GH_Contains| n6
-    n1 -->|GH_CanDeployToEnvironment| n7
     n1 -.->|GH_Contains| n7
-    n1 -->|GH_CanUseRunner| n8
-    n1 -.->|GH_IsEligibleFor| n8
-    n1 -->|GH_HasSecret| n9
-    n1 -->|GH_HasVariable| n10
-    n1 -.->|GH_CanUseRunner| n11
-    n1 -.->|GH_Contains| n11
+    n1 -.->|GH_Contains| n2
+    n1 -->|GH_CanDeployToEnvironment| n8
+    n1 -.->|GH_Contains| n8
+    n1 -->|GH_CanUseRunner| n9
+    n1 -.->|GH_IsEligibleFor| n9
+    n1 -->|GH_HasSecret| n10
+    n1 -->|GH_HasVariable| n11
+    n1 -.->|GH_CanUseRunner| n12
     n1 -.->|GH_Contains| n12
-    n1 -->|GH_HasSecret| n12
     n1 -.->|GH_Contains| n13
-    n1 -->|GH_HasVariable| n13
+    n1 -->|GH_HasSecret| n13
     n1 -.->|GH_Contains| n14
+    n1 -->|GH_HasVariable| n14
     n1 -.->|GH_Contains| n15
+    n1 -.->|GH_Contains| n16
 ```

{openhound_github-0.12.0 → openhound_github-0.13.0}/descriptions/nodes/GH_User.md

@@ -36,13 +36,14 @@ graph LR
     n4["GH_SecretScanningAlert"]
     n5["GH_Branch"]
     n6["GH_BranchProtectionRule"]
-    n7["GH_EnterpriseRole"]
-    n8["GH_Environment"]
-    n9["GH_OrgRole"]
-    n10["GH_PersonalAccessToken"]
-    n11["GH_PersonalAccessTokenRequest"]
-    n12["GH_RepoRole"]
-    n13["GH_TeamRole"]
+    n7["GH_DeployKey"]
+    n8["GH_EnterpriseRole"]
+    n9["GH_Environment"]
+    n10["GH_OrgRole"]
+    n11["GH_PersonalAccessToken"]
+    n12["GH_PersonalAccessTokenRequest"]
+    n13["GH_RepoRole"]
+    n14["GH_TeamRole"]
     n0 -.->|GH_HasMember| n1
     n2 -.->|GH_MapsToUser| n1
     n3 -.->|GH_MapsToUser| n1
@@ -50,12 +51,13 @@ graph LR
     n1 -.->|GH_CanWriteBranch| n5
     n1 -.->|GH_BypassPullRequestAllowances| n6
     n1 -.->|GH_RestrictionsCanPush| n6
-    n1 -->|GH_HasRole| n7
-    n1 -.->|GH_ApprovesDeploymentTo| n8
-    n1 -->|GH_CanDeployToEnvironment| n8
-    n1 -->|GH_HasRole| n9
-    n1 -.->|GH_HasPersonalAccessToken| n10
-    n1 -.->|GH_HasPersonalAccessTokenRequest| n11
-    n1 -->|GH_HasRole| n12
+    n1 -.->|GH_AddedDeployKey| n7
+    n1 -->|GH_HasRole| n8
+    n1 -.->|GH_ApprovesDeploymentTo| n9
+    n1 -->|GH_CanDeployToEnvironment| n9
+    n1 -->|GH_HasRole| n10
+    n1 -.->|GH_HasPersonalAccessToken| n11
+    n1 -.->|GH_HasPersonalAccessTokenRequest| n12
     n1 -->|GH_HasRole| n13
+    n1 -->|GH_HasRole| n14
 ```

{openhound_github-0.12.0 → openhound_github-0.13.0}/extension/schema.json

@@ -190,6 +190,14 @@
       "icon": "lock-open",
       "color": "#66C7E8"
     },
+    {
+      "name": "GH_DeployKey",
+      "display_name": "GitHub Deploy Key",
+      "description": "A repository-scoped SSH deploy key that grants read-only or read-write access to repository contents",
+      "is_display_kind": true,
+      "icon": "key",
+      "color": "#F9C74F"
+    },
     {
       "name": "GH_Secret",
       "display_name": "GitHub Secret",
@@ -325,6 +333,11 @@
       "description": "Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)",
       "is_traversable": false
     },
+    {
+      "name": "GH_AddedDeployKey",
+      "description": "User added this repository deploy key",
+      "is_traversable": false
+    },
     {
       "name": "GH_CreateEnterpriseOrganizations",
       "description": "[Enterprise] Enterprise role can create organizations",
@@ -962,7 +975,7 @@
     },
     {
       "name": "GH_CanAccess",
-      "description": "Personal access token or app installation can access this repository or organization",
+      "description": "Personal access token, app installation, or deploy key can access this repository or organization",
       "is_traversable": false
     },
     {

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/graphql.py

@@ -283,6 +283,9 @@ query RepoRefs($login: String!, $count: Int!, $after: String) {
                 environments(first: 1) {
                     totalCount
                 }
+                deployKeys(first: 1) {
+                    totalCount
+                }
             }
             pageInfo { endCursor hasNextPage }
         }

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/kinds/edges.py

@@ -87,6 +87,7 @@ HAS_PERSONAL_ACCESS_TOKEN_REQUEST = "GH_HasPersonalAccessTokenRequest"
 # Secret and variable edges
 HAS_SECRET = "GH_HasSecret"
 HAS_VARIABLE = "GH_HasVariable"
+ADDED_DEPLOY_KEY = "GH_AddedDeployKey"
 
 # App installation edges
 INSTALLED_AS = "GH_InstalledAs"

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/kinds/nodes.py

@@ -33,6 +33,7 @@ REPO_ROLE = "GH_RepoRole"
 REPO_SECRET = "GH_RepoSecret"
 REPO_VARIABLE = "GH_RepoVariable"
 REPO_RUNNER = "GH_RepoRunner"
+DEPLOY_KEY = "GH_DeployKey"
 
 DEFAULT_ROLE = "GH_RepoRole"
 

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/lookup.py

@@ -54,6 +54,35 @@ class GithubLookup(LookupManager):
             [org_login],
         )
 
+    @lru_cache
+    def user_node_id_for_login(self, org_login: str, user_login: str) -> str | None:
+        return self._find_single_object(
+            f"""
+            WITH candidate_users AS (
+                SELECT 0 AS priority, u.id
+                FROM {self.schema}.users u
+                WHERE lower(u.org_login) = lower(?)
+                  AND lower(u.login) = lower(?)
+
+                UNION ALL
+
+                SELECT 1 AS priority, eu.id
+                FROM {self.schema}.enterprise_users eu
+                JOIN {self.schema}.enterprise e
+                  ON lower(e.slug) = lower(eu.enterprise_slug)
+                JOIN {self.schema}.enterprise_organizations eo
+                  ON eo.enterprise_node_id = e.id
+                WHERE lower(eo.login) = lower(?)
+                  AND lower(eu.login) = lower(?)
+            )
+            SELECT id
+            FROM candidate_users
+            ORDER BY priority
+            LIMIT 1
+            """,
+            [org_login, user_login, org_login, user_login],
+        )
+
     @lru_cache
     def org_login(self) -> str | None:
         res = self._find_single_object(
@@ -605,20 +634,21 @@ class GithubLookup(LookupManager):
     @lru_cache
     def repository_graphql_counts(
         self, repository_node_id: str
-    ) -> tuple[int | None, int | None]:
+    ) -> tuple[int | None, int | None, int | None]:
         row = self._find_single_row(
             f"""
-            SELECT branch_count, environment_count
+            SELECT branch_count, environment_count, deploy_key_count
             FROM {self.schema}.repositories_graphql
             WHERE id = ?
             """,
             [repository_node_id],
         )
         if row is None:
-            return None, None
+            return None, None, None
         return (
             None if row[0] is None else int(row[0]),
             None if row[1] is None else int(row[1]),
+            None if row[2] is None else int(row[2]),
         )
 
     @lru_cache

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/main.py

@@ -67,6 +67,7 @@ def preproc(ctx: PreProcContext):
         "external_identities": "external_identities",
         "applications": "applications",
         "enterprise": "enterprise",
+        "enterprise_users": "enterprise_users",
         "enterprise_organizations": "enterprise_organizations",
         "enterprise_scim_groups": "enterprise_scim_groups",
         "enterprise_runner_groups": "enterprise_runner_groups",

{openhound_github-0.12.0 → openhound_github-0.13.0}/src/openhound_github/models/__init__.py

@@ -22,6 +22,7 @@ from .env_secret import EnvironmentSecret
 from .env_variable import EnvironmentVariable
 from .environment import Environment
 from .environment_branch_policy import EnvironmentBranchPolicy
+from .deploy_key import DeployKey
 from .external_identity import ExternalIdentity
 from .org import Organization
 from .org_role import OrgRole
@@ -132,6 +133,7 @@ __all__ = [
     "EnvironmentSecret",
     "EnvironmentVariable",
     "EnvironmentBranchPolicy",
+    "DeployKey",
     "Enterprise",
     "EnterpriseAdmin",
     "EnterpriseManagedUser",