feat(github): add 64 actions for MCP parity and modularise the integration - #443
Closed
risheetperi wants to merge 2 commits into
Closed
feat(github): add 64 actions for MCP parity and modularise the integration#443risheetperi wants to merge 2 commits into
risheetperi wants to merge 2 commits into
Conversation
…ation
Brings the action set to the union of what shipped and every GitHub MCP
server capability, implemented directly against the GitHub REST API.
47 -> 111 actions.
New actions by domain:
search (7) code, commits, issues, PRs, repositories, users, orgs
issues (12) label CRUD, issue labels, sub-issue hierarchy, org
issue types and fields
pull requests (13) update, update branch, diff, files, commits, combined
status, reviews, comments, reply, and the pending
review lifecycle
workflows (12) dispatch, re-run, re-run failed, cancel, jobs, job
logs, artifacts, run timing, delete logs
security (11) code scanning, Dependabot, secret scanning, code
quality findings, security advisories
repos/files (4) fork, git tree, collaborators, atomic push_files
users/gists (5) teams, team members, gist get/list/update
Restructures github.py into an actions/ package with a shared helpers.py,
matching the layout the tooling already supports and facebook/, aws/,
humanitix/ and instagram/ already use. Existing action bodies moved with
identical ASTs; behaviour is unchanged apart from the two fixes below.
Adds the security_events OAuth scope, required by the Dependabot, code
scanning and secret scanning actions.
Fixes:
- diff_branch_to_branch crashed on commits with a null author (deleted
accounts, some bot commits) - the same fix list_commits received in
2.4.0, which this action never got.
- get_rate_limit crashed when GitHub omits the graphql resource block,
which it does for some token types.
Secret scanning never returns the leaked credential: both actions send
hide_secret=true and shape output through a strict allow-list, so a
provider-side regression still cannot leak it.
Documentation: the README previously listed 14 OAuth scopes when the
integration requests 6, and described a result/error output envelope the
actions never returned. The action reference is now generated from
config.json so it cannot drift again.
389 unit tests, 94% coverage. Live read-only tests cover the new read
actions against public repositories; write tests are gated behind both
the destructive marker and a GITHUB_TEST_REPO env var.
Closes #442
🔍 Integration Validation ResultsCommit:
✅ Structure Check output✅ Code Check output✅ Tests Check output✅ README Check output✅ Version Check output |
The tooling flags ~=2.0.0 as deprecated. 2.0.1 is what CI and local development already resolve to under the previous pin, so this only makes the declared floor match what is actually installed and tested against. Clears the sole remaining validation warning.
Contributor
Author
|
Closed for now |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #442
Brings the GitHub integration's action set to the union of what shipped and every GitHub MCP server capability, implemented directly against the GitHub REST API. 47 → 111 actions.
The
security_eventsOAuth scope must be grantable by Autohive's shared GitHub OAuth app.auth.typeisplatform, so scopes are requested against that shared app, which I can't inspect from this repo. If it can't grantsecurity_events, the 11 Security actions will return403. The fix is a one-line revert inconfig.jsonplus dropping those actions — nothing else in this PR depends on it.What's new
push_filesOut of scope, documented in the README rather than silently dropped: Notifications, Discussions (GraphQL-only), Projects v2, Stars, Copilot, and
create_pull_request_with_copilot(no public API — the MCP server implements it against its own hosted service).Structural change
github.py(2,834 lines) becomes a ~30-line entry point plus anactions/package and a sharedhelpers.py. This is the layoutvalidate_integration.pyalready whitelists and thatfacebook/,aws/,humanitix/andinstagram/already use.Existing action bodies were moved by AST line range and verified to have identical ASTs afterwards — the move is behaviour-preserving.
github/__init__.pyis deleted deliberately: with anactions/package present,from github import githubinside an action module resolves to the partially-initialised package and binds the module rather than theIntegration, so every decorator raisesAttributeError. This is why the validator makes__init__.pyoptional whenactions/exists, and why no other modular integration has one.Notable API findings
These changed the implementation and are worth a reviewer's attention:
addPullRequestReviewCommentis deprecated wholesale (every input field flagged, removal slated 2023-10-01).add_comment_to_pending_reviewusesaddPullRequestReviewThreadinstead. This is the only GraphQL action — REST cannot attach a comment to an existing pending review.page. Dependabot alerts, code quality findings and both advisory endpoints return an identical set forpage=1andpage=2. Walking them with the normal paginator would have silently duplicated results. Those actions return a single capped page, with a regression test each.302to a signed ZIP;context.fetchfollows redirects and decodes as text, so.text()raisesUnicodeDecodeErrorand the SDK's own handler re-raises. Both actions returnarchive_download_urlmetadata and never request the archive.get_job_logsis unaffected (plain text) and returns log content, tail-trimmed./search/orgs— confirmed 404.search_orgsscopes/search/userswithtype:org.search_issuesandsearch_pull_requestsshare/search/issues, disambiguated by the documentedis:issue/is:prqualifiers, injected only when the caller hasn't already scoped the query.Security
list_secret_scanning_alertsandget_secret_scanning_alertreturn alert metadata but never the leaked credential. Both hardcodehide_secret=truewith no opt-out, and shape output through a strict allow-list, so a provider-side regression still cannot leak it. Tests assert the secret never appears in the serialised output, and that a caller-suppliedhide_secret: falseis ignored.Bug fixes
diff_branch_to_branchcrashed on commits with a null author (deleted accounts, some bot commits) — the same crashlist_commitswas fixed for in 2.4.0, which this action never received.get_rate_limitcrashed when GitHub omits thegraphqlresource block, which it does for some token types.Both have regression tests.
Documentation
The README claimed 14 OAuth scopes when
config.jsonrequests six (it listedadmin:org,admin:public_key,admin:gpg_key,write:packages,read:packagesamong others), and documented aresult/erroroutput envelope the actions have never returned. The action reference is now generated fromconfig.json, so it cannot drift again, and each scope carries a justification.Verification
pip-auditfails on my machine only —ensurepipaborts building its isolated temp venv, and it fails identically on a trivially cleanrequests==2.32.3file.requirements.txtis byte-identical to master (SDK pin only, no new dependencies).Live tests: read-only coverage for the new read actions runs against public repositories and needs
GITHUB_ACCESS_TOKEN. Write coverage is double-gated behind thedestructivemarker and aGITHUB_TEST_REPOenv var, so nothing destructive can run against a repository that wasn't explicitly nominated. Neither has been run yet — credentials pending. Flagging that plainly rather than implying live verification that hasn't happened.Author commitment
Every endpoint was verified against the live GitHub documentation before implementation; anything that turned out deprecated, GraphQL-only or absent is called out above rather than guessed at. Dead code was removed as part of this change: three previously-unused
GitHubAPImethods are now wired up (update_pull_request,get_gist,list_gists) and the two that remained genuinely unused (get_webhook,delete_gist) are deleted — no unused methods remain.