GitHub Integration

async def install_webhook(
    owner: str,
    repo: str,
    access_token: str,
    backend_url: str,
) -> tuple[int, str]:
    webhook_secret = secrets.token_hex(32)
    payload_url = f"{backend_url}/api/v1/webhooks/github"

    resp = await client.post(
        f"https://api.github.com/repos/{owner}/{repo}/hooks",
        headers={"Authorization": f"Bearer {access_token}"},
        json={
            "name": "web",
            "active": True,
            "events": ["pull_request", "issues"],
            "config": {
                "url": payload_url,
                "content_type": "json",
                "secret": webhook_secret,
                "insecure_ssl": "0",
            },
        },
    )
    webhook_id = resp.json()["id"]
    return webhook_id, webhook_secret

def get_github_token() -> str:
    if settings.APP_ENV == "production":
        if settings.GITHUB_PAT:
            return settings.GITHUB_PAT.strip()
        raise ValueError("GITHUB_PAT is required in production.")

    # Try GitHub CLI first (local dev)
    try:
        result = subprocess.run(
            ["gh", "auth", "token"],
            capture_output=True, text=True, timeout=5
        )
        if result.returncode == 0 and result.stdout.strip():
            return result.stdout.strip()
    except (FileNotFoundError, subprocess.TimeoutExpired):
        pass

    # Fallback to PAT
    if settings.GITHUB_PAT:
        return settings.GITHUB_PAT.strip()

    raise ValueError("No GitHub token available.")

async def get_pr_state(owner: str, repo: str, pr_number: int) -> str:
    cache_key = f"{owner}/{repo}#{pr_number}"
    cached = self._pr_status_cache.get(cache_key)
    if cached and cached[1] > time.monotonic():
        return cached[0]  # "open" | "closed" | "merged"

    pr = await self.get_pull_request(owner, repo, pr_number)
    status = "merged" if pr.get("merged") else pr.get("state", "open")
    self._pr_status_cache[cache_key] = (status, time.monotonic() + ttl)
    return status