openhound-github 0.22.0__tar.gz → 0.22.1__tar.gz

{openhound_github-0.22.0 → openhound_github-0.22.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.22.0
+Version: 0.22.1
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -66,6 +66,27 @@ Both values must be provided together when overriding the GitHub.com defaults.
 Endpoint URLs must use HTTPS and share the same origin. GitHub App
 `credentials.api_uri` may override only the path on that same origin.
 
+### Request timeouts and retries
+
+REST and GraphQL collection requests use a 10-second connection timeout and a
+30-second read timeout. Transient HTTP 5xx errors, connection failures, and
+timeouts share a limit of three attempts (the initial attempt plus two retries).
+Adaptive GraphQL pagination shares that limit across page sizes: HTTP 502/504
+responses trigger smaller-page attempts instead of a new retry budget.
+
+After retries are exhausted, existing resource handlers log the failure and
+continue with unaffected scopes. Already emitted records are retained, but the
+affected scope may be incomplete. Resources that require all pages before
+emitting records retain that behavior.
+
+Workflow collection skips `dynamic/` paths. Missing workflow files are logged
+and skipped without passing failed items to job or step parsing.
+
+Rate-limit responses and GitHub App token refresh retain their existing retry
+handling and do not consume the transient-failure budget. These timeouts are
+not an overall request deadline. App authentication requests and credential
+inventory CSV downloads retain their separate timeout settings.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.

{openhound_github-0.22.0 → openhound_github-0.22.1}/README.md

@@ -55,6 +55,27 @@ Both values must be provided together when overriding the GitHub.com defaults.
 Endpoint URLs must use HTTPS and share the same origin. GitHub App
 `credentials.api_uri` may override only the path on that same origin.
 
+### Request timeouts and retries
+
+REST and GraphQL collection requests use a 10-second connection timeout and a
+30-second read timeout. Transient HTTP 5xx errors, connection failures, and
+timeouts share a limit of three attempts (the initial attempt plus two retries).
+Adaptive GraphQL pagination shares that limit across page sizes: HTTP 502/504
+responses trigger smaller-page attempts instead of a new retry budget.
+
+After retries are exhausted, existing resource handlers log the failure and
+continue with unaffected scopes. Already emitted records are retained, but the
+affected scope may be incomplete. Resources that require all pages before
+emitting records retain that behavior.
+
+Workflow collection skips `dynamic/` paths. Missing workflow files are logged
+and skipped without passing failed items to job or step parsing.
+
+Rate-limit responses and GitHub App token refresh retain their existing retry
+handling and do not consume the transient-failure budget. These timeouts are
+not an overall request deadline. App authentication requests and credential
+inventory CSV downloads retain their separate timeout settings.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.

openhound_github-0.22.1/src/openhound_github/github_rest_client.py

@@ -0,0 +1,90 @@
+from contextlib import contextmanager
+from contextvars import ContextVar
+from dataclasses import dataclass
+from functools import wraps
+
+from dlt.sources.helpers import requests
+from requests.exceptions import ChunkedEncodingError, ConnectionError, Timeout
+from tenacity import RetryCallState
+from tenacity.stop import stop_base
+
+from openhound_github.github_retry import should_retry_github_response
+
+__all__ = ["github_http_session", "should_retry_github_response"]
+
+
+@dataclass
+class GraphQLPageRetryBudget:
+    """Share transient failures across page sizes without changing other requests."""
+
+    failures: int = 0
+
+    @property
+    def exhausted(self) -> bool:
+        return self.failures >= 3
+
+    @contextmanager
+    def activate(self):
+        token = _graphql_page_budget.set(self)
+        try:
+            yield
+        finally:
+            _graphql_page_budget.reset(token)
+
+
+_graphql_page_budget: ContextVar[GraphQLPageRetryBudget | None] = ContextVar(
+    "github_graphql_page_budget", default=None
+)
+
+
+class _StopAfterTransientFailures(stop_base):
+    """Count transient failures per send, independently of other retry reasons."""
+
+    def __call__(self, retry_state: RetryCallState) -> bool:
+        outcome = retry_state.outcome
+        if outcome is None:
+            return False
+        exception = outcome.exception()
+        response = None
+        if isinstance(exception, requests.HTTPError):
+            response = exception.response
+        elif exception is None:
+            response = outcome.result()
+        transient = isinstance(exception, (ConnectionError, Timeout, ChunkedEncodingError)) or (
+            response is not None and 500 <= response.status_code < 600
+        )
+        page_budget = _graphql_page_budget.get()
+        if page_budget is not None:
+            page_budget.failures += int(transient)
+            # Return gateway errors immediately so pagination can shrink the page.
+            return page_budget.exhausted or (
+                response is not None and response.status_code in (502, 504)
+            )
+        failures = getattr(retry_state, "_github_transient_failures", 0) + int(transient)
+        setattr(retry_state, "_github_transient_failures", failures)
+        return failures >= 3
+
+
+def github_http_session(retry_condition):
+    """Bound transient failures while retaining DLT's existing retry policy."""
+    session = requests.Client(
+        request_timeout=(10, 30),
+        status_codes=tuple(range(500, 600)),
+        retry_condition=retry_condition,
+    ).session
+    # Keep the configured overall limit for rate limits and credential refresh.
+    # RetryCallState is new for every send, including concurrent requests.
+    retry = session.send.retry
+    retry.stop = _StopAfterTransientFailures() | retry.stop
+    send = session.send
+
+    @wraps(send)
+    def send_with_status_check(request, **kwargs):
+        response = send(request, **kwargs)
+        # RESTClient calls send directly, bypassing Session.request's status check.
+        # Raise only after the retry loop finishes so scope handlers can skip it.
+        response.raise_for_status()
+        return response
+
+    session.send = send_with_status_check
+    return session

{openhound_github-0.22.0 → openhound_github-0.22.1}/src/openhound_github/helpers.py

@@ -14,6 +14,7 @@ from dlt.sources.helpers.rest_client.paginators import (
 from requests import Request
 
 from openhound_github.auth import GitHubAppInstallationAuth
+from openhound_github.github_rest_client import GraphQLPageRetryBudget
 from openhound_github.github_retry import (
     is_primary_rate_limit_response,
     is_secondary_rate_limit_response,
@@ -230,9 +231,9 @@ def adaptive_graphql_paginate(
 ) -> Iterator[dict[str, Any]]:
     """Yield GraphQL pages while adapting connection size after gateway failures.
 
-    The underlying HTTP session still owns ordinary request retries. This helper
-    handles the remaining terminal 502/504 case by retrying the same cursor with
-    progressively smaller connection sizes.
+    HTTP retries and smaller-page recovery share three transient attempts per
+    page. Gateway errors return immediately so the next attempt can shrink the
+    page; rate-limit and credential-refresh retries retain their existing policy.
     """
     if not page_sizes or any(page_size <= 0 for page_size in page_sizes):
         raise ValueError("page_sizes must contain positive integers")
@@ -270,6 +271,7 @@ def adaptive_graphql_paginate(
         page_data: dict[str, Any] | None = None
         paginator: GraphQLCursorPaginator | None = None
         successful_page_size: int | None = None
+        retry_budget = GraphQLPageRetryBudget()
 
         for index, page_size in enumerate(candidate_sizes):
             request_variables = {
@@ -278,10 +280,11 @@ def adaptive_graphql_paginate(
                 page_size_variable: page_size,
             }
             try:
-                response = client.post(
-                    graphql_path,
-                    json={"query": query, "variables": request_variables},
-                )
+                with retry_budget.activate():
+                    response = client.post(
+                        graphql_path,
+                        json={"query": query, "variables": request_variables},
+                    )
                 response.raise_for_status()
                 response_json = response.json()
                 paginator = GraphQLCursorPaginator(
@@ -303,7 +306,11 @@ def adaptive_graphql_paginate(
                 status_code = _graphql_gateway_status(error)
                 next_page_size = (
                     candidate_sizes[index + 1]
-                    if status_code is not None and index + 1 < len(candidate_sizes)
+                    if (
+                        status_code is not None
+                        and index + 1 < len(candidate_sizes)
+                        and not retry_budget.exhausted
+                    )
                     else None
                 )
                 if next_page_size is not None:

{openhound_github-0.22.0 → openhound_github-0.22.1}/src/openhound_github/resources/organization.py

@@ -6,6 +6,7 @@ from threading import Lock
 from typing import Any, Iterator
 from urllib.parse import quote
 
+import dlt
 from dlt.sources.helpers import requests
 from dlt.sources.helpers.rest_client.client import RESTClient
 from dlt.sources.helpers.rest_client.paginators import (
@@ -1475,7 +1476,7 @@ def workflows(repo: Repository, ctx: SourceContext):
         Workflow (Workflow): An active workflow record.
     """
 
-    @app.defer
+    @dlt.defer
     def _workflow_file_contents(
         client: RESTClient,
         repo: Repository,
@@ -1487,11 +1488,30 @@ def workflows(repo: Repository, ctx: SourceContext):
             return None
 
         params = {"ref": repo.default_branch} if repo.default_branch else None
-        response = client.get(
-            f"/repos/{repo.full_name}/contents/{path}", params=params
-        ).json()
+        try:
+            response = client.get(
+                f"/repos/{repo.full_name}/contents/{path}", params=params
+            ).json()
+            content = response.get("content")
+        except Exception as exc:
+            # Return None so DLT drops the failed item. app.defer returns [],
+            # which can reach the job/step transformers as an invalid Workflow.
+            if (
+                isinstance(exc, requests.HTTPError)
+                and exc.response is not None
+                and exc.response.status_code == 404
+            ):
+                logger.warning(
+                    "Skipping workflow '%s' in repository '%s': file unavailable at ref '%s' (HTTP 404)",
+                    path, repo.full_name, repo.default_branch,
+                )
+            else:
+                logger.error(
+                    "Unable to collect workflow '%s' in repository '%s': %s",
+                    path, repo.full_name, exc,
+                )
+            return None
 
-        content = response.get("content")
         if not content:
             return None
 
@@ -1517,6 +1537,9 @@ def workflows(repo: Repository, ctx: SourceContext):
     ):
         for workflow in page:
             if workflow.get("state") == "active":
+                path = workflow.get("path")
+                if not path or path.startswith("dynamic/"):
+                    continue
                 if workflow_permissions is None:
                     workflow_permissions = _repository_workflow_permissions(
                         ctx, client, repo.full_name

{openhound_github-0.22.0 → openhound_github-0.22.1}/src/openhound_github/source.py

@@ -8,7 +8,6 @@ from urllib.parse import urlparse
 import dlt
 from dlt.common.configuration import configspec
 from dlt.common.configuration.specs import CredentialsConfiguration
-from dlt.sources.helpers import requests
 from dlt.sources.helpers.rest_client.auth import AuthConfigBase
 from dlt.sources.helpers.rest_client.auth import BearerTokenAuth
 from dlt.sources.helpers.rest_client.client import RESTClient
@@ -27,6 +26,7 @@ from openhound_github.helpers import (
     DEFAULT_GITHUB_REST_API_URL,
     github_retry_policy,
 )
+from openhound_github.github_rest_client import github_http_session
 from openhound_github.main import app
 from openhound_github.models.saml_helpers import (
     DEFAULT_GITHUB_DEPLOYMENT_ID,
@@ -352,10 +352,7 @@ def source(
             },
             auth=auth,
             paginator=HeaderLinkPaginator(),
-            session=requests.Client(
-                status_codes=tuple(range(500, 600)),
-                retry_condition=github_retry_policy(auth),
-            ).session,
+            session=github_http_session(github_retry_policy(auth)),
         )
 
     def clients(auth: AuthConfigBase) -> tuple[RESTClient, RESTClient]:

openhound_github-0.22.1/tests/test_collection_continuation.py

@@ -0,0 +1,153 @@
+"""Exercise exhausted retries through the real parallel DLT resource wrappers."""
+
+import json
+import logging
+from collections import Counter
+from threading import Lock
+from types import SimpleNamespace
+from urllib.parse import parse_qs, urlparse
+
+import dlt
+import pytest
+from dlt.sources.helpers.rest_client.auth import BearerTokenAuth
+from dlt.sources.helpers.rest_client.client import RESTClient
+from dlt.sources.helpers.rest_client.paginators import HeaderLinkPaginator
+from requests import Response
+from requests.exceptions import ReadTimeout
+
+from openhound_github.github_rest_client import github_http_session
+from openhound_github.helpers import github_retry_policy
+from openhound_github.resources.organization import (
+    OrgContext,
+    SourceContext,
+    environment_branch_policies,
+    environment_secrets,
+    environment_variables,
+    environments,
+    organizations,
+)
+
+
+def _client(monkeypatch, route):
+    session = github_http_session(github_retry_policy(BearerTokenAuth("test")))
+    session.send.retry.sleep = lambda _: None
+    calls = Counter()
+    lock = Lock()
+
+    def send(request, **kwargs):
+        url = urlparse(request.url)
+        page = parse_qs(url.query).get("page", ["1"])[0]
+        with lock:
+            calls[url.path, page] += 1
+        outcome = route(url.path, page)
+        if isinstance(outcome, Exception):
+            raise outcome
+        status, payload, more = outcome
+        response = Response()
+        response.status_code = status
+        response.url = request.url
+        response.request = request
+        response._content = json.dumps(payload).encode()
+        if more:
+            response.headers["Link"] = f'<https://api.github.com{url.path}?page=2>; rel="next"'
+        return response
+
+    monkeypatch.setattr(session.get_adapter("https://"), "send", send)
+    return RESTClient(
+        "https://api.github.com", session=session, paginator=HeaderLinkPaginator(),
+    ), calls
+
+
+def _failure(error):
+    return ReadTimeout("simulated read timeout") if error == "timeout" else (
+        503, {"message": "simulated unavailable endpoint"}, False,
+    )
+
+
+def _field(row, name):
+    return row[name] if isinstance(row, dict) else getattr(row, name)
+
+
+@pytest.mark.parametrize("error", ["503", "timeout"])
+def test_later_organizations_collect_after_exhausted_retries(monkeypatch, caplog, error):
+    def route(path, page):
+        if path == "/orgs/bad":
+            return _failure(error)
+        org = path.split("/")[2]
+        return 200, {"login": org, "node_id": f"ORG_{org}"}, False
+
+    client, calls = _client(monkeypatch, route)
+    ctx = SourceContext(client=client, organizations=[
+        OrgContext(client=client, org_name=name) for name in ("first", "bad", "last")
+    ])
+
+    with caplog.at_level(logging.ERROR):
+        rows = list(organizations(ctx))
+
+    assert {_field(row, "login") for row in rows} == {"first", "last"}
+    assert calls["/orgs/bad", "1"] == 3
+    assert "processing organization 'bad'" in caplog.text
+
+
+@pytest.mark.parametrize("error", ["503", "timeout"])
+def test_later_repositories_collect_and_partial_page_is_retained(monkeypatch, caplog, error):
+    def route(path, page):
+        repo = path.split("/")[3]
+        if repo == "bad" and page == "2":
+            return _failure(error)
+        environment = {
+            "id": 1, "node_id": f"ENV_{repo}", "name": repo,
+            "url": "https://api.github.com/example", "html_url": "https://github.com/example",
+            "created_at": "2026-01-01T00:00:00Z", "updated_at": "2026-01-01T00:00:00Z",
+        }
+        return 200, {"environments": [environment]}, repo == "bad"
+
+    client, calls = _client(monkeypatch, route)
+    ctx = SourceContext(client=client, organizations=[OrgContext(client=client, org_name="org")])
+    parents = dlt.resource([
+        SimpleNamespace(id=f"REPO_{name}", name=name, org_login="org", environment_count=1)
+        for name in ("first", "bad", "last")
+    ], name="probe_repositories")
+
+    with caplog.at_level(logging.ERROR):
+        rows = list(parents | environments(ctx))
+
+    assert {_field(row, "repository_name") for row in rows} == {"first", "bad", "last"}
+    assert calls["/repos/org/bad/environments", "2"] == 3
+    assert "resource 'environments'" in caplog.text
+    assert "/repos/org/bad/environments" in caplog.text or error == "timeout"
+
+
+@pytest.mark.parametrize("transformer, suffix, selector", [
+    (environment_variables, "variables", "variables"),
+    (environment_secrets, "secrets", "secrets"),
+    (environment_branch_policies, "deployment-branch-policies", "branch_policies"),
+])
+@pytest.mark.parametrize("error", ["503", "timeout"])
+def test_later_environments_collect_after_partial_failure(
+    monkeypatch, caplog, transformer, suffix, selector, error,
+):
+    def route(path, page):
+        name = path.split("/")[5]
+        if name == "bad" and page == "2":
+            return _failure(error)
+        item = {"name": "item", "value": "value", "id": 1, "node_id": "POLICY",
+                "created_at": "2026-01-01T00:00:00Z"}
+        return 200, {selector: [item]}, name == "bad"
+
+    client, calls = _client(monkeypatch, route)
+    ctx = SourceContext(client=client, organizations=[OrgContext(client=client, org_name="org")])
+    parents = dlt.resource([
+        SimpleNamespace(
+            name=name, node_id=f"ENV_{name}", org_login="org", repository_name="repo",
+            repository_full_name="org/repo", repository_node_id="REPO",
+            has_custom_branch_policies=True, required_reviewers=False, prevent_self_review=False,
+        ) for name in ("first", "bad", "last")
+    ], name="probe_environments")
+
+    with caplog.at_level(logging.ERROR):
+        rows = list(parents | transformer(ctx))
+
+    assert {_field(row, "environment_name") for row in rows} == {"first", "bad", "last"}
+    assert calls[f"/repos/org/repo/environments/bad/{suffix}", "2"] == 3
+    assert f"resource '{transformer.name}'" in caplog.text

{openhound_github-0.22.0 → openhound_github-0.22.1}/tests/test_github_app_retry.py

@@ -4,10 +4,12 @@ from datetime import datetime, timedelta, timezone
 from threading import Event, Lock
 
 import requests
+import pytest
 from dlt.sources.helpers.rest_client.auth import BearerTokenAuth
 
 from openhound_github.auth import GitHubAppInstallationAuth, TokenResponse
 from openhound_github.helpers import github_retry_policy
+from openhound_github.github_rest_client import github_http_session
 
 
 class FakeInstallation:
@@ -243,3 +245,37 @@ def test_retry_policy_does_not_repair_bad_credentials_for_bearer_token_auth() ->
 
     assert should_retry is False
     assert request.headers["Authorization"] == "Bearer static-token"
+
+
+@pytest.mark.parametrize("replacement_rejected", [False, True])
+def test_http_session_retries_with_refreshed_credentials(monkeypatch, replacement_rejected):
+    installation = FakeInstallation("new-token")
+    auth = GitHubAppInstallationAuth(installation=installation)
+    auth.access_token = "old-token"
+    auth.expires_at = datetime.now(timezone.utc) + timedelta(hours=1)
+    session = github_http_session(github_retry_policy(auth))
+    session.auth = auth
+    session.send.retry.sleep = lambda _: None
+    # Two transient failures must leave room for credential recovery.
+    statuses = iter([503, 503, 401, 401 if replacement_rejected else 200])
+    authorizations = []
+
+    def send(request, **kwargs):
+        authorizations.append(request.headers.get("Authorization"))
+        response = requests.Response()
+        response.status_code = next(statuses)
+        response.request = request
+        response.url = request.url
+        response._content = b'{"message":"Bad credentials"}'
+        return response
+
+    monkeypatch.setattr(session.get_adapter("https://"), "send", send)
+    if replacement_rejected:
+        with pytest.raises(requests.HTTPError) as caught:
+            session.get("https://api.github.com/example")
+        assert caught.value.response.status_code == 401
+    else:
+        assert session.get("https://api.github.com/example").status_code == 200
+
+    assert authorizations == ["Bearer old-token"] * 3 + ["Bearer new-token"]
+    assert installation.token_calls == 1

openhound_github-0.22.1/tests/test_github_rest_client.py

@@ -0,0 +1,161 @@
+import json
+from unittest.mock import Mock
+
+import pytest
+from dlt.sources.helpers import requests as dlt_requests
+from requests import HTTPError, Response
+from requests.exceptions import ChunkedEncodingError, ConnectionError, ReadTimeout
+from dlt.sources.helpers.rest_client.auth import BearerTokenAuth
+
+from openhound_github.github_rest_client import github_http_session, should_retry_github_response
+from openhound_github.helpers import github_retry_policy
+
+
+def make_response(
+    status_code: int,
+    *,
+    headers: dict[str, str] | None = None,
+    body: dict[str, object] | None = None,
+    text: str | None = None,
+) -> Response:
+    response = Response()
+    response.status_code = status_code
+    response.headers.update(headers or {})
+    if body is not None:
+        response._content = json.dumps(body).encode("utf-8")
+        response.headers.setdefault("Content-Type", "application/json")
+    else:
+        response._content = (text or "").encode("utf-8")
+    response.url = "https://api.github.com/example"
+    return response
+
+
+def test_retries_primary_rate_limit_response() -> None:
+    response = make_response(
+        403,
+        headers={"x-ratelimit-remaining": "0"},
+        body={"message": "API rate limit exceeded"},
+    )
+
+    assert should_retry_github_response(response, None) is True
+
+
+def test_retries_secondary_rate_limit_response() -> None:
+    response = make_response(
+        429,
+        body={"message": "You have exceeded a secondary rate limit."},
+    )
+
+    assert should_retry_github_response(response, None) is True
+
+
+def test_does_not_retry_non_rate_limit_403() -> None:
+    response = make_response(
+        403,
+        body={"message": "Resource not accessible by integration"},
+    )
+
+    assert should_retry_github_response(response, None) is False
+
+
+def _session(monkeypatch, outcomes):
+    session = github_http_session(github_retry_policy(BearerTokenAuth("test")))
+    send = Mock(side_effect=outcomes)
+    monkeypatch.setattr(session.get_adapter("https://"), "send", send)
+    session.send.retry.sleep = lambda _: None
+    return session, send
+
+
+@pytest.mark.parametrize("status", [500, 502, 503, 504])
+def test_server_failures_stop_after_three_attempts(monkeypatch, status):
+    session, send = _session(monkeypatch, [make_response(status) for _ in range(4)])
+
+    with pytest.raises(HTTPError) as caught:
+        session.get("https://api.github.com/example")
+
+    assert caught.value.response.status_code == status
+    assert send.call_count == 3
+    assert all(call.kwargs["timeout"] == (10, 30) for call in send.call_args_list)
+
+
+@pytest.mark.parametrize("error", [ReadTimeout, ConnectionError, ChunkedEncodingError])
+def test_network_failures_stop_after_three_attempts(monkeypatch, error):
+    session, send = _session(monkeypatch, [error("interrupted") for _ in range(4)])
+
+    with pytest.raises(error):
+        session.get("https://api.github.com/example")
+
+    assert send.call_count == 3
+
+
+def test_transient_failure_count_resets_for_each_request(monkeypatch):
+    session, send = _session(monkeypatch, [
+        make_response(503), make_response(503), make_response(200),
+        make_response(503), make_response(503), make_response(200),
+    ])
+
+    assert session.get("https://api.github.com/example").status_code == 200
+    assert session.get("https://api.github.com/example").status_code == 200
+    assert send.call_count == 6
+
+
+def test_mixed_server_and_network_failures_share_budget(monkeypatch):
+    session, send = _session(monkeypatch, [
+        make_response(503), ReadTimeout("interrupted"), make_response(502),
+        make_response(200),
+    ])
+
+    with pytest.raises(HTTPError):
+        session.get("https://api.github.com/example")
+
+    assert send.call_count == 3
+
+
+def test_rate_limit_retries_do_not_consume_transient_budget(monkeypatch):
+    session, send = _session(monkeypatch, [
+        *[make_response(429, body={"message": "secondary rate limit"}) for _ in range(4)],
+        make_response(503), make_response(503), make_response(200),
+    ])
+
+    assert session.get("https://api.github.com/example").status_code == 200
+    assert send.call_count == 7
+
+
+@pytest.mark.parametrize(("status", "headers", "body"), [
+    (403, {"x-ratelimit-remaining": "0", "x-ratelimit-reset": "4102444800"},
+     {"message": "API rate limit exceeded"}),
+    (429, {}, {"message": "secondary rate limit"}),
+    (429, {"Retry-After": "12"}, {"message": "Please wait"}),
+    (200, {"x-ratelimit-resource": "graphql", "x-ratelimit-remaining": "0",
+           "x-ratelimit-reset": "4102444800"},
+     {"errors": [{"message": "API rate limit exceeded"}]}),
+])
+def test_rate_limit_attempts_and_waits_match_existing_session(
+    monkeypatch, status, headers, body,
+):
+    monkeypatch.setenv("RUNTIME__REQUEST_MAX_ATTEMPTS", "5")
+    observations = []
+    for updated in (False, True):
+        policy = github_retry_policy(BearerTokenAuth("test"))
+        session = (
+            github_http_session(policy) if updated else dlt_requests.Client(
+                status_codes=tuple(range(500, 600)), retry_condition=policy,
+            ).session
+        )
+        send = Mock(side_effect=[
+            make_response(status, headers=headers, body=body) for _ in range(5)
+        ])
+        monkeypatch.setattr(session.get_adapter("https://"), "send", send)
+        sleep = Mock()
+        session.send.retry.sleep = sleep
+        if status != 200:
+            with pytest.raises(HTTPError):
+                session.get("https://api.github.com/example")
+        else:
+            response = session.get("https://api.github.com/graphql")
+            assert response.json()["errors"]
+        observations.append((send.call_count, [float(c.args[0]) for c in sleep.call_args_list]))
+
+    assert observations[0][0] == 5
+    assert len(observations[0][1]) == 4
+    assert observations[1] == observations[0]