fix: handle unexpected API errors in immutable release settings fetch

Distinguish 404 (feature not enabled) from genuine errors (5xx, 403)
in _fill_immutable_releases, and gracefully degrade when the org-level
immutable releases endpoint returns 404 instead of raising RuntimeError.

Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Mikaël Barbero <mikael.barbero@eclipse-foundation.org>

Author: mbarbero

otterdog/providers/github/rest/org_client.py

@@ -139,6 +139,9 @@ async def _get_immutable_releases_settings(self, org_id: str) -> dict[str, Any]:
         try:
             return await self.requester.request_json("GET", f"/orgs/{org_id}/settings/immutable-releases")
         except GitHubException as ex:
+            if ex.status == 404:
+                _logger.debug("immutable releases not available for org '%s', treating as disabled", org_id)
+                return {"enforced_repositories": "none"}
             raise RuntimeError(f"failed retrieving immutable release settings for org '{org_id}':\n{ex}") from ex
 
     async def _update_immutable_releases_settings(self, org_id: str, data: dict[str, Any]) -> None:

otterdog/providers/github/rest/repo_client.py

@@ -612,8 +612,15 @@ async def _update_vulnerability_alerts(self, org_id: str, repo_name: str, vulner
     async def _fill_immutable_releases(self, org_id: str, repo_name: str, repo_data: dict[str, Any]) -> None:
         _logger.debug("retrieving immutable release settings for '%s/%s'", org_id, repo_name)
 
-        status, _ = await self.requester.request_raw("GET", f"/repos/{org_id}/{repo_name}/immutable-releases")
-        repo_data["immutable_releases_enabled"] = status == 200
+        status, body = await self.requester.request_raw("GET", f"/repos/{org_id}/{repo_name}/immutable-releases")
+        if status == 200:
+            repo_data["immutable_releases_enabled"] = True
+        elif status == 404:
+            repo_data["immutable_releases_enabled"] = False
+        else:
+            raise RuntimeError(
+                f"failed retrieving immutable release settings for repo '{org_id}/{repo_name}': {status}: {body}"
+            )
 
     async def _update_immutable_releases(self, org_id: str, repo_name: str, immutable_releases_enabled: bool) -> None:
         _logger.debug("updating immutable release settings for '%s/%s'", org_id, repo_name)

tests/providers/github/rest/test_org_client.py

@@ -99,6 +99,31 @@ async def mock_get_simple_repo_data(org_id, repo_name):
             },
         )
 
+    async def test_get_settings_falls_back_when_immutable_releases_not_available(self):
+        async def mock_request_json(method, url):
+            if url == "/orgs/org":
+                return {"billing_email": "billing@example.com"}
+            if url == "/orgs/org/settings/immutable-releases":
+                raise GitHubException(url, 404, "Not Found")
+
+            raise AssertionError(f"unexpected call {method} {url}")
+
+        mock_requester = pretend.stub(request_json=pretend.call_recorder(mock_request_json))
+        mock_restapi = pretend.stub(requester=mock_requester)
+        org_client = OrgClient(mock_restapi)
+
+        result = await org_client.get_settings(
+            "org",
+            {
+                "billing_email",
+                "immutable_releases_enforced_repositories",
+                "immutable_releases_selected_repositories",
+            },
+        )
+
+        assert result["immutable_releases_enforced_repositories"] == "none"
+        assert result["immutable_releases_selected_repositories"] == []
+
 
 class TestOrgClientForkPrApprovalPolicy:
     async def test_get_fork_pr_approval_policy_success(self):

tests/providers/github/rest/test_repo_client.py

@@ -199,6 +199,18 @@ async def mock_request_raw(method, url):
         ]
         assert repo_data["immutable_releases_enabled"] is False
 
+    async def test_fill_immutable_releases_raises_on_unexpected_status(self):
+        async def mock_request_raw(method, url):
+            return (500, "Internal Server Error")
+
+        mocked_restapi = pretend.stub(requester=pretend.stub(request_raw=pretend.call_recorder(mock_request_raw)))
+        repo_client = RepoClient(mocked_restapi)
+
+        repo_data = {}
+
+        with pytest.raises(RuntimeError, match="failed retrieving immutable release settings"):
+            await repo_client._fill_immutable_releases("test-org", "test-repo", repo_data)
+
 
 class TestRepoClientForkPrApprovalPolicy:
     async def test_get_fork_pr_approval_policy_success(self):