leeyspaul commented on code in PR #66255:
URL: https://github.com/apache/airflow/pull/66255#discussion_r3182833719
##########
dev/breeze/src/airflow_breeze/utils/github.py:
##########
@@ -35,6 +37,81 @@
if TYPE_CHECKING:
from requests import Response
+GITHUB_TOKEN_ENV_VARS = ("GH_TOKEN", "GITHUB_TOKEN")
+
+
+def env_without_github_tokens(env: Mapping[str, str] | None = None) ->
dict[str, str]:
+ """Return a copy of *env* with ambient GitHub CLI token variables
removed."""
+ cleaned_env = dict(os.environ if env is None else env)
+ for token_env_var in GITHUB_TOKEN_ENV_VARS:
+ cleaned_env.pop(token_env_var, None)
+ return cleaned_env
+
+
+def get_github_token_from_env(env: Mapping[str, str] | None = None) -> str |
None:
+ """Return an ambient GitHub token using the same precedence as the GitHub
CLI."""
+ source_env = os.environ if env is None else env
+ for token_env_var in GITHUB_TOKEN_ENV_VARS:
+ token = source_env.get(token_env_var)
+ if token:
+ return token
+ return None
+
+
+def run_gh_command(
+ command: Sequence[str],
+ *,
+ retry_with_github_token: bool = True,
+ env: Mapping[str, str] | None = None,
+ **kwargs: Any,
+) -> subprocess.CompletedProcess[Any]:
+ """
+ Run a ``gh`` command using stored ``gh auth login`` credentials before
ambient token env vars.
+
+ Locally, ``GH_TOKEN``/``GITHUB_TOKEN`` can shadow the user's normal GitHub
CLI login. We first
+ run with those variables removed, then retry with the original environment
only when that fails.
+ """
+ command_env = os.environ.copy() if env is None else dict(env)
+ check = kwargs.pop("check", False)
+ result = subprocess.run(command,
env=env_without_github_tokens(command_env), check=False, **kwargs)
+ if result.returncode == 0:
+ return result
+ if not retry_with_github_token or not
get_github_token_from_env(command_env):
+ if check:
+ result.check_returncode()
+ return result
+ return subprocess.run(command, env=command_env, check=check, **kwargs)
+
+
+def retrieve_github_token(token: str | None = None, *, env: Mapping[str, str]
| None = None) -> str | None:
+ """
+ Resolve a GitHub token for local Breeze commands.
+
+ Explicit ``--github-token`` values are preserved. Ambient
``GH_TOKEN``/``GITHUB_TOKEN`` values are
+ used only after trying the user's stored ``gh auth login`` credential.
+ """
+ env_token = get_github_token_from_env(env)
+ source_env = os.environ if env is None else env
+ env_tokens = {
+ source_env[token_env_var] for token_env_var in GITHUB_TOKEN_ENV_VARS
if source_env.get(token_env_var)
+ }
+ if token and token not in env_tokens:
Review Comment:
I updated the `retrieve_github_token()` docstring to spell out the actual
rule: non-empty token arguments are preserved only when they do not match
`GH_TOKEN` or `GITHUB_TOKEN`; matching values are treated as ambient env input
and Breeze tries `gh auth login` first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
