fix(github): GetTagForSHA must paginate exhaustively — bounded 20-tag lookup misses old tags (#78)

The pre-extraction bounded version survived in the SDK while Pilot's in-tree
client was upgraded to exhaustive pagination (per_page=100, up to 50 pages).
A SHA tagged beyond the window made hosts treat already-released commits as
untagged, stalling release draining. Caught by Pilot's
TestHandleReleasing_ExhaustiveTagDrain during the M7 4d.1 client swap.

Author: alekspetrov

sdk/integrations/github/client.go

@@ -639,15 +639,26 @@ func (c *Client) ListTags(ctx context.Context, owner, repo string, perPage int)
 	return result, nil
 }
 
-// GetTagForSHA returns the tag name if a tag exists at the given SHA, or empty string if none.
+// GetTagForSHA returns the tag name if a tag exists at the given SHA, or empty
+// string if none. Paginates exhaustively (per_page=100, up to 50 pages) — a
+// bounded lookup misses tags beyond the first page and stalls release draining
+// for SHAs tagged long ago (caught by Pilot's TestHandleReleasing_ExhaustiveTagDrain).
 func (c *Client) GetTagForSHA(ctx context.Context, owner, repo, sha string) (string, error) {
-	tags, err := c.ListTags(ctx, owner, repo, 20)
-	if err != nil {
-		return "", err
-	}
-	for _, tag := range tags {
-		if tag.Commit.SHA == sha {
-			return tag.Name, nil
+	const perPage = 100
+	const maxPages = 50
+	for page := 1; page <= maxPages; page++ {
+		path := fmt.Sprintf("/repos/%s/%s/tags?per_page=%d&page=%d", owner, repo, perPage, page)
+		var batch []*Tag
+		if err := c.doRequest(ctx, http.MethodGet, path, nil, &batch); err != nil {
+			return "", err
+		}
+		for _, tag := range batch {
+			if tag.Commit.SHA == sha {
+				return tag.Name, nil
+			}
+		}
+		if len(batch) < perPage {
+			break
 		}
 	}
 	return "", nil

sdk/integrations/github/errors_test.go

@@ -2,7 +2,9 @@ package github
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
@@ -185,3 +187,38 @@ func TestGetOpenSubIssueNumbers_NoNativeLinks(t *testing.T) {
 		t.Errorf("got (%v, %v), want (nil, false)", numbers, hasLinks)
 	}
 }
+
+func TestGetTagForSHA_Exhaustive(t *testing.T) {
+	// Target SHA appears on page 2 — a bounded single-page lookup misses it.
+	page1 := make([]map[string]interface{}, 100)
+	for i := range page1 {
+		page1[i] = map[string]interface{}{"name": fmt.Sprintf("v1.0.%d", i), "commit": map[string]string{"sha": fmt.Sprintf("p1sha%03d", i)}}
+	}
+	page2 := []map[string]interface{}{
+		{"name": "v0.9.7-target", "commit": map[string]string{"sha": "deepsha"}},
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Query().Get("page") == "2" {
+			_ = json.NewEncoder(w).Encode(page2)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(page1)
+	}))
+	defer srv.Close()
+
+	c := NewClientWithBaseURL(testutil.FakeGitHubToken, srv.URL)
+	name, err := c.GetTagForSHA(context.Background(), "o", "r", "deepsha")
+	if err != nil {
+		t.Fatalf("GetTagForSHA: %v", err)
+	}
+	if name != "v0.9.7-target" {
+		t.Errorf("tag = %q, want v0.9.7-target (page-2 tag must be found)", name)
+	}
+
+	// Absent SHA terminates on the short page without error.
+	name, err = c.GetTagForSHA(context.Background(), "o", "r", "nosuch")
+	if err != nil || name != "" {
+		t.Errorf("absent SHA: got (%q, %v), want (\"\", nil)", name, err)
+	}
+}