fix: Migrate off deprecated GraphQL APIs

[howbazaar]

Summary

• Migrates stacklet-admin off GraphQL fields/mutations marked @deprecated in the platform schema, across the repository, account-group, policy-collection, and binding domains.
• repository commands move from the legacy repository/repositories/addRepository/removeRepository/processRepository API to repositoryConfig/repositoryConfigs/addRepositoryConfig/removeRepositoryConfig/triggerRepositoryScan. As a result:
  • repository add drops --branch-name, --policy-file-suffix, --policy-directory, --deep-import (no longer accepted by addRepositoryConfig).
  • repository process/scan/show/remove take --uuid instead of --url; repository scan drops --start-rev-spec.
• account-group commands move AccountGroup.items/itemCount to accountMappings, and addAccountGroupItems/removeAccountGroupItems to upsertAccountGroupMappings/removeAccountGroupMappings. remove-item keeps its existing --uuid/--key/--provider interface via an internal mapping-id lookup (paginated, so it works past the first page), since the new mutation needs an opaque mapping id. add-item drops --provider (unused by the new mutation).
• policy-collection commands move PolicyCollection.items/itemCount to policyMappings (the add-item/remove-item mutations themselves were not deprecated, so no CLI interface change there).
• binding commands move the deprecated top-level variables arg/field to the structured executionConfig { variables }.
• Account and policy commands needed no changes.

Test plan

• uv run pytest tests/ — 90 passed
• uv run ruff check .
• uv run ruff format --check .
• uv run ty check stacklet/
• uv run deptry .
• Manual verification against a live local platform deploy (not just mocked unit tests):
  • repository list / repository show — confirmed real RepositoryConfig data comes back correctly shaped via repositoryConfigs/repositoryConfig.
  • policy-collection list — confirmed policyMappings.pageInfo shape.
  • account-group add (with --region), add-item, show — confirmed the new accountMappings shape end-to-end (create group → add mapping → verify mapping visible).
  • account-group remove-item — confirmed the mapping-id lookup pre-check resolves correctly and the mapping is actually removed (this is the path fixed for pagination per Greptile's review comment on this PR).
  • account-group remove / account remove — cleanup succeeded.
  • binding list — query accepted by the schema (no existing bindings locally to exercise the executionConfig round-trip on add/update).
  • All test data created during manual verification was removed afterward; no residue left in the shared local deploy.
  • Note: account-group add requires --region for AWS groups — pre-existing server-side validation unrelated to this migration, just something to be aware of when testing.
  • Not yet exercised manually: repository add (needs a reachable git URL) and binding add/update (no binding fixture available locally).

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR replaces deprecated platform GraphQL operations and response fields.

• Migrates repository commands to repository-config queries and mutations.
• Migrates account-group and policy-collection output to mapping connections.
• Resolves account mapping IDs through paginated lookup before removal.
• Moves binding variables under structured execution configuration.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported lookup limit is resolved by advancing through account-mapping pages with endCursor until the target mapping is found, and no blocking failure remains.

Important Files Changed

Filename	Overview
stacklet/client/platform/commands/account_group.py	Adds cursor-based mapping lookup before removal, resolving the previously reported 1000-entry limit.
stacklet/client/platform/graphql/snippets/account_group.py	Migrates account-group fields and mutations to account-mapping APIs.
stacklet/client/platform/graphql/snippets/repository.py	Migrates repository operations and response shapes to repository-config APIs.
stacklet/client/platform/graphql/snippets/binding.py	Moves binding variables into executionConfig for queries and mutations.
stacklet/client/platform/graphql/snippets/policy_collection.py	Replaces deprecated policy-collection item fields with policy-mapping connections.
tests/test_account_group.py	Verifies account-mapping add, lookup, pagination, removal, and missing-item behavior.
tests/test_repository.py	Updates repository command coverage for the replacement GraphQL API.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    CLI[account-group remove-item] --> Lookup[Query accountMappings page]
    Lookup --> Match{Mapping found?}
    Match -- Yes --> Remove[Remove mapping by opaque ID]
    Match -- No, next page --> Cursor[Advance with endCursor]
    Cursor --> Lookup
    Match -- No more pages --> Error[Report mapping not found]

Loading

_{Reviews (2): Last reviewed commit: "fix: Page through all account-group mapp..." | Re-trigger Greptile}

[jtroup]

Seems reasonable - please either complete the last test in the checklist, or remove the item before comitting. Thanks @howbazaar

[howbazaar]

Running against platform functional tests as additional end to end checks.