update handling of GitHub auth for local, interactive use

[jameslamb]

Closes #171

Contributes to https://github.com/rapidsai/build-infra/issues/237

Replaces #168

Some of the scripts in this project use the GitHub CLI. Those require authentication with GitHub.

In CI jobs, that authentication is provided by setting environment variable GH_TOKEN. When using the scripts interactively (e.g., when reproducing CI), it'd be helpful to prompt for an interactive login flow if the local environment isn't already authenticated.

This does that, via that following:

• in rapids-prompt-local-github-auth, prompts for interactive authentication if not currently auth'd with GitHub (determined via gh auth status)
• invokes rapids-prompt-local-github-auth in every script that uses the GitHub CLI and which might be called interactively (so excludes rapids-upload-to-anaconda-github, for example)

Notes for Reviewers

How I tested this

Logged out of GitHub locally.

unset GH_TOKEN
gh auth logout

gh auth status
# You are not logged into any GitHub hosts. To log in, run: gh auth login

Tried to download some rmm conda packages.

RAPIDS_BUILD_WORKFLOW_NAME="build.yaml" \
RAPIDS_BUILD_TYPE="branch" \
RAPIDS_REPOSITORY="rapidsai/rmm" \
RAPIDS_REF_NAME="branch-25.06" \
RAPIDS_SHA="dbd8cc7a5f2230a21551670106d4bcd5e507441e" \
rapids-download-from-github \
    rmm_conda_python_cuda12_py312_aarch64

Got an interactive prompt to login:

Followed that flow, then was logged in and saw packages download successfully.

Ran that same rapids-download-from-github command again, saw the downloads work and NOT re-prompt for auth.

Logged out again, then set the GH_TOKEN environment variable to a GitHub "classic" token (docs) that only had the repo scope.

 export GH_TOKEN=<redacted>
gh auth status

Confirming that it only had the repo scope:

  ✓ Logged in to github.com account jameslamb (GH_TOKEN)
  - Active account: true
  - Git operations protocol: https
  - Token: ghp_************************************
  - Token scopes: 'repo'
  ! Missing required token scopes: 'read:org'
  - To request missing scopes, run: gh auth refresh -h github.com

Running the same rapids-download-from-github command as above worked, without re-prompting for auth.

Also tested this in an rmm PR:

• PR: WIP: [DO NOT MERGE] test changes to GitHub Actions configs and scripts rmm#1909
• build link: https://github.com/rapidsai/rmm/actions/runs/14916596953/job/41903518506?pr=1909

[bdice]

I know this isn't ready for review yet - just noting that you already solved one of my questions elsewhere, so no need to respond on that issue.

So far you're doing exactly what I think is needed here.

[bdice]

Yes! I came to this conclusion too: #171 (comment)

[jameslamb]

Yeah! Everywhere that we invoke gh in a tool that might be used interactively, this should be called.

The if gh auth status makes it idempotent (ensures you aren't put through the interactive login workflow multiple times).

[jameslamb]

The use of set -u a few lines up means that if you fail to pass any arguments to this script, it never gets through this if and emits the informative error message. Defaulting back to null if ${1} is undefined fixes that.

rapids-download-from-github
# tools/rapids-download-from-github: line 9: $1: unbound variable

[bdice]

I observed this too and didn’t realize it was a bug. 🥲

[jameslamb]

Ha yup! Same thing as conda-forge/arrow-cpp-feedstock#1696, it's easy to trip over stuff like this with set -u.

[jameslamb]

Removing this because this script doesn't directly call the gh CLI. These rapids-prompt-local-github-auth calls should only be placed in scripts that directly need GitHub auth, to minimize unnecessary calls.

Found those like this:

git grep 'gh '

[jameslamb]

Ok this one's ready for review whenever you have time @bdice

[bdice]

I observed this too and didn’t realize it was a bug. 🥲