Skip to content

feat: add graph-source-github-issues package - #28

Merged
Mearman merged 2 commits into
mainfrom
feat/source-github-issues
Oct 10, 2026
Merged

Mearman merged 2 commits into
mainfrom
feat/source-github-issues

Conversation

@Mearman

@Mearman Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member

Phase 2 of the process-graph plan, second half: @exadev/process-graph-source-github-issues, the GitHub issues adapter for the GraphSource port. Stacked on #25; I will retarget it to main once that merges.

It is ported from Graphle's GraphQL client and generalised. A scope is github:owner/repo or github:owner (every repository the account owns, listed by name), across any number of organisations. Each issue becomes a bound activity github:owner/repo#n whose actor is its repository; each blockedBy entry is a transition from the blocker; sub-issues are child-of relations, assignees assigned-to relations, repositories part-of their owner; open and closed map to open and done in the overlay. Blockers and sub-issues in other repositories and organisations come with their own repository and owner, so a cross-organisation dependency is a hand-off in the model. Nested connections are read to their end with follow-up queries rather than truncated.

Pages are one page of one repository's issues. The cursor holds the scope, the position in the owner's repository listing and GitHub's issue cursor, so a sync resumes in another process; a stale listing position carries on after that listing page. Rate limiting in each of GitHub's forms (429, 403 with no requests remaining or naming a secondary limit, a RATE_LIMITED GraphQL error) becomes TOO_MANY_REQUESTS with the reset instant from x-ratelimit-reset or retry-after and an injected clock; 401 becomes UNAUTHORIZED; NOT_FOUND and FORBIDDEN answers, and an owner GitHub answers with null, are gaps.

The token comes from an injected port asked per owner. The ./node entry point adds githubTokenFromEnvironment, which uses GITHUB_TOKEN or asks gh auth token once, and reports a failure without the CLI's output. The main entry point stays isomorphic.

The offline tests replay GraphQL exchanges recorded from public repositories (GitHub's octo-org, ExaDev/document-schema.js, Mearman/agent-permissions, whose issue is blocked by ExaDev/trilean#11) at a small page size, so owner listings and every nested connection span several requests. The fixture holds request documents, variables, statuses and bodies only; scripts/record-fixtures.ts re-records it. The conformance kit passes over the fixtures in process and over a message port, and the tests assert the cross-organisation transition, every blocker and sub-issue past the first page, the octo-org repositories and the gap and error mappings. The live tests (PROCESS_GRAPH_LIVE_GITHUB=1 pnpm test:integration) run the kit and a cross-organisation sync against the real API; I ran them locally and they passed. Without the variable they are reported as skipped.

The npm name needs reserving before this merges: npm-reserve @exadev/process-graph-source-github-issues --trust ExaDev/process-graph --workflow ci.yml.

@Mearman
Mearman marked this pull request as ready for review October 10, 2026 16:18
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-10-10T17:55:59.234043Z 307199c Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Mearman
Mearman changed the base branch from feat/source-contract to main October 10, 2026 16:39
@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

The GitHub issues adapter for the GraphSource port, ported from Graphle's GraphQL client
and generalised: scopes name a repository or every repository an owner has, across any
number of organisations. An issue is a bound activity whose actor is its repository,
blockedBy is a transition from the blocker, sub-issues and assignees are relations, and
open or closed is the overlay. Blockers and sub-issues in other repositories and
organisations are included, and every nested connection is read to its end.

Cursors record the scope, the owner's repository listing position and GitHub's issue
cursor as plain data. Rate limiting in each of GitHub's forms is TOO_MANY_REQUESTS with
the reset instant, HTTP 401 is UNAUTHORIZED, and NOT_FOUND or FORBIDDEN answers are gaps.

The token comes from an injected port; the ./node entry point reads GITHUB_TOKEN or the
GitHub CLI's token and never logs it. Offline tests replay exchanges recorded from public
repositories and pass the conformance kit in process and over a message port; live tests
run when PROCESS_GRAPH_LIVE_GITHUB=1 and are reported as skipped otherwise.
@Mearman
Mearman force-pushed the feat/source-github-issues branch from 493e8f1 to 4a8ab27 Compare October 10, 2026 16:48
@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 493e8f112a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 4a8ab273ca

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 307199c9f5

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman
Mearman merged commit c6f383e into main Oct 10, 2026
14 checks passed
@github-actions

Copy link
Copy Markdown

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant