Merge pull request #404 from nazarli-shabnam/fix/workflow-dispatch-403-and-bulk

feat(automation): surface real GitHub dispatch error + add bulk workflow dispatch

Author: nazarli-shabnam

apps/api/src/routers/automation.py

@@ -24,6 +24,9 @@
 from src.core.rbac import OrgContext, assert_owner_matches_org, require_org_role
 from src.repositories import audit_repo, tenant_repo
 from src.schemas.automation import (
+    DispatchAllInput,
+    DispatchAllResponse,
+    DispatchAllResult,
     DispatchInput,
     DispatchResponse,
     RunSummary,
@@ -143,6 +146,118 @@ def _dispatch(
     return DispatchResponse(dispatched=True, message="Workflow dispatched.")
 
 
+# Bounds one bulk-dispatch request: each active workflow is one sequential GitHub POST,
+# and the request shouldn't fan out unboundedly. Repos with more workflows than this
+# should dispatch individually.
+_BULK_DISPATCH_MAX = 40
+
+
+def _github_message(exc: httpx.HTTPStatusError) -> str:
+    try:
+        return exc.response.json().get("message") or ""
+    except (ValueError, AttributeError):
+        return ""
+
+
+def _list_all_workflows(client: GitHubClient, owner: str, repo: str) -> list[dict]:
+    """Every workflow across every page. GitHub's `/actions/workflows` returns a
+    ``{total_count, workflows}`` object (not a bare array), so request_paginated's
+    Link-following can't be reused -- page through it explicitly instead."""
+    workflows: list[dict] = []
+    page = 1
+    while True:
+        data = client.request(
+            "GET",
+            f"/repos/{owner}/{repo}/actions/workflows",
+            params={"per_page": 100, "page": page},
+        )
+        batch = data.get("workflows", [])
+        workflows.extend(batch)
+        total = data.get("total_count")
+        # Stop on an empty page (guards against a misbehaving API and infinite loops),
+        # a short page, or once total_count says we've seen everything.
+        if not batch or len(batch) < 100 or (total is not None and len(workflows) >= total):
+            break
+        page += 1
+    return workflows
+
+
+def _dispatch_all(
+    db: Session,
+    owner: str,
+    repo: str,
+    payload: DispatchAllInput,
+    token: str,
+    actor: str,
+    tenant_id: int | None = None,
+) -> DispatchAllResponse:
+    client = GitHubClient(token)
+    try:
+        all_workflows = _list_all_workflows(client, owner, repo)
+    except (httpx.HTTPStatusError, httpx.RequestError) as exc:
+        raise _github_error(exc) from exc
+
+    active = [w for w in all_workflows if w.get("state") == "active"]
+    if len(active) > _BULK_DISPATCH_MAX:
+        raise HTTPException(
+            status_code=422,
+            detail=f"Too many workflows for bulk dispatch ({_BULK_DISPATCH_MAX} max); dispatch individually.",
+        )
+
+    results: list[DispatchAllResult] = []
+    for w in active:
+        wf_id, name = w["id"], w["name"]
+        # One audit row per attempted workflow, written before the call -- same
+        # convention as _dispatch, so a rejected bulk dispatch still leaves a record.
+        audit_repo.write(
+            db,
+            actor,
+            "automation.workflow.dispatch",
+            f"{owner}/{repo}#{wf_id}",
+            {"ref": payload.ref, "inputs": {}, "bulk": True},
+            tenant_id=tenant_id,
+        )
+        try:
+            client.request(
+                "POST",
+                f"/repos/{owner}/{repo}/actions/workflows/{wf_id}/dispatches",
+                json={"ref": payload.ref, "inputs": {}},
+            )
+        except httpx.HTTPStatusError as exc:
+            message = _github_message(exc)
+            if exc.response.status_code == 422 and "workflow_dispatch" in message:
+                results.append(
+                    DispatchAllResult(
+                        workflow_id=wf_id, name=name, status="skipped",
+                        message="No workflow_dispatch trigger",
+                    )
+                )
+            else:
+                results.append(
+                    DispatchAllResult(
+                        workflow_id=wf_id, name=name, status="failed",
+                        message=message or f"GitHub API error: {exc.response.status_code}",
+                    )
+                )
+        except httpx.RequestError:
+            results.append(
+                DispatchAllResult(
+                    workflow_id=wf_id, name=name, status="failed",
+                    message="GitHub API unreachable",
+                )
+            )
+        else:
+            results.append(DispatchAllResult(workflow_id=wf_id, name=name, status="dispatched"))
+
+    return DispatchAllResponse(
+        ref=payload.ref,
+        results=results,
+        dispatched_count=sum(r.status == "dispatched" for r in results),
+        skipped_count=sum(r.status == "skipped" for r in results),
+        failed_count=sum(r.status == "failed" for r in results),
+    )
+
+
 # ── org-scoped ───────────────────────────────────────────────────────────────
 
 @router.get("/orgs/{org_login}/repos/{owner}/{repo}/workflows", response_model=WorkflowsResponse)
@@ -200,6 +315,25 @@ def org_dispatch_workflow(
     return _dispatch(db, owner, repo, workflow_id, payload, token, actor=user.email, tenant_id=ctx.org.tenant_id)
 
 
+@router.post("/orgs/{org_login}/repos/{owner}/{repo}/workflows/dispatch-all", response_model=DispatchAllResponse)
+def org_dispatch_all_workflows(
+    org_login: str,
+    owner: str,
+    repo: str,
+    payload: DispatchAllInput,
+    ctx: OrgContext = Depends(require_org_role(min_role="admin")),
+    user: UserOut = Depends(require_auth),
+    db: Session = Depends(get_db),
+):
+    assert_owner_matches_org(owner, ctx)
+    client_token = payload.token.get_secret_value() if payload.token else None
+    try:
+        token = resolve_org_token(db, org_id=ctx.org.id, account_login=owner, client_token=client_token)
+    except NoGitHubTokenAvailable as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    return _dispatch_all(db, owner, repo, payload, token, actor=user.email, tenant_id=ctx.org.tenant_id)
+
+
 # ── personal-scoped ──────────────────────────────────────────────────────────
 
 @router.get("/me/repos/{owner}/{repo}/workflows", response_model=WorkflowsResponse)
@@ -251,3 +385,22 @@ def personal_dispatch_workflow(
         raise HTTPException(status_code=400, detail=str(exc))
     personal_tenant = tenant_repo.ensure_personal_tenant(db, user.id)
     return _dispatch(db, owner, repo, workflow_id, payload, token, actor=user.email, tenant_id=personal_tenant.id)
+
+
+@router.post("/me/repos/{owner}/{repo}/workflows/dispatch-all", response_model=DispatchAllResponse)
+def personal_dispatch_all_workflows(
+    owner: str,
+    repo: str,
+    payload: DispatchAllInput,
+    user: UserOut = Depends(require_auth),
+    db: Session = Depends(get_db),
+):
+    client_token = payload.token.get_secret_value() if payload.token else None
+    try:
+        token = resolve_owner_token(db, user_id=user.id, owner=owner, client_token=client_token, min_role="admin")
+    except InsufficientOrgRole as exc:
+        raise HTTPException(status_code=403, detail=str(exc))
+    except NoGitHubTokenAvailable as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    personal_tenant = tenant_repo.ensure_personal_tenant(db, user.id)
+    return _dispatch_all(db, owner, repo, payload, token, actor=user.email, tenant_id=personal_tenant.id)

apps/api/src/schemas/automation.py

@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Annotated
+from typing import Annotated, Literal
 
 from pydantic import BaseModel, Field, SecretStr
 
@@ -54,3 +54,27 @@ class DispatchInput(BaseModel):
 class DispatchResponse(BaseModel):
     dispatched: bool
     message: str | None = None
+
+
+class DispatchAllInput(BaseModel):
+    # Same token fallback as DispatchInput. No per-workflow `inputs` -- a single
+    # inputs dict can't sensibly apply across every workflow in the repo.
+    token: SecretStr | None = None
+    ref: str = Field(max_length=255)
+
+
+class DispatchAllResult(BaseModel):
+    workflow_id: int
+    name: str
+    # "skipped" = the workflow has no `workflow_dispatch` trigger (GitHub 422); this
+    # is an expected outcome for a bulk fire, not a failure.
+    status: Literal["dispatched", "skipped", "failed"]
+    message: str | None = None
+
+
+class DispatchAllResponse(BaseModel):
+    ref: str
+    results: list[DispatchAllResult]
+    dispatched_count: int
+    skipped_count: int
+    failed_count: int

apps/api/src/services/app_permissions.py

@@ -11,8 +11,8 @@
 The permission keys and levels are GitHub's own (see the REST "Get an installation"
 response ``permissions`` object): ``administration``/``issues``/``pull_requests``/
 ``contents``/``vulnerability_alerts`` (Dependabot alerts)/``security_events`` (code
-scanning)/``secret_scanning_alerts``/``members`` accept ``read``|``write``; ``workflows``
-is ``write``-only.
+scanning)/``secret_scanning_alerts``/``members``/``actions`` accept ``read``|``write``;
+``workflows`` is ``write``-only.
 """
 
 from __future__ import annotations
@@ -73,6 +73,10 @@ class FeatureSpec:
         "Dependabot auto-triage",
         {"pull_requests": "write", "contents": "write"},
     ),
+    "workflow_dispatch": FeatureSpec(
+        "Workflow dispatch (Automation page)",
+        {"actions": "write"},
+    ),
 }
 
 

apps/api/src/services/github_client.py

@@ -21,7 +21,14 @@ def github_error(exc: Exception) -> HTTPException:
     """Map an httpx exception raised by GitHubClient into the HTTPException every
     GitHub-proxying router returns to its caller."""
     if isinstance(exc, httpx.HTTPStatusError):
-        return HTTPException(status_code=400, detail=f"GitHub API error: {exc.response.status_code}")
+        detail = f"GitHub API error: {exc.response.status_code}"
+        try:
+            message = exc.response.json().get("message")
+        except (ValueError, AttributeError):
+            message = None
+        if message:
+            detail = f"{detail}: {message}"
+        return HTTPException(status_code=400, detail=detail)
     if isinstance(exc, httpx.RequestError):
         return HTTPException(status_code=503, detail="GitHub API unreachable")
     raise exc

apps/api/tests/test_app_permissions.py

@@ -42,10 +42,20 @@ def test_blocked_features_full_write_grant_unblocks_all():
         "pull_requests": "write",
         "contents": "write",
         "workflows": "write",
+        "actions": "write",
     }
     assert app_permissions.blocked_features(granted) == []
 
 
+def test_workflow_dispatch_needs_actions_write():
+    # Actions: read (enough to list workflows) does not satisfy the dispatch write need.
+    blocked = {b.feature: b.missing for b in app_permissions.blocked_features({"actions": "read"})}
+    assert blocked["workflow_dispatch"] == {"actions": "write"}
+    assert "workflow_dispatch" not in {
+        b.feature for b in app_permissions.blocked_features({"actions": "write"})
+    }
+
+
 def test_blocked_features_order_is_stable():
     blocked = app_permissions.blocked_features({})
     assert [b.feature for b in blocked] == list(app_permissions.FEATURE_PERMISSIONS)