From ed0e7f23fe06b8b09fb1d26d9e2e81be50fb8028 Mon Sep 17 00:00:00 2001
From: James Lamb <jlamb@nvidia.com>
Date: Thu, 8 May 2025 15:15:25 -0500
Subject: [PATCH 1/2] update handling of GitHub auth for local, interactive use

---
 tools/_rapids-get-pr-artifact-github     |  2 ++
 tools/rapids-download-conda-from-github  |  1 -
 tools/rapids-download-from-github        |  4 ++-
 tools/rapids-download-wheels-from-github |  1 -
 tools/rapids-prompt-local-github-auth    | 33 +++++++++++++++++++-----
 5 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/tools/_rapids-get-pr-artifact-github b/tools/_rapids-get-pr-artifact-github
index 2c5636b..b1c2b94 100755
--- a/tools/_rapids-get-pr-artifact-github
+++ b/tools/_rapids-get-pr-artifact-github
@@ -20,6 +20,8 @@ if [[ "${package_format}" = "wheel" && -z "${RAPIDS_PY_WHEEL_NAME:+placeholder}"
     exit 1
 fi
 
+source rapids-prompt-local-github-auth
+
 # If commit is not provided, get the latest commit on the PR
 if [[ -z "${commit}" ]]; then
     commit=$(rapids-retry --quiet gh pr view "${pr}" --repo rapidsai/"${repo}" --json headRefOid --jq '.headRefOid')
diff --git a/tools/rapids-download-conda-from-github b/tools/rapids-download-conda-from-github
index 58eeb1d..652047b 100755
--- a/tools/rapids-download-conda-from-github
+++ b/tools/rapids-download-conda-from-github
@@ -8,7 +8,6 @@ set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-conda-from-github"
 
 source rapids-prompt-local-repo-config
-source rapids-prompt-local-github-auth
 
 # Validate package type argument
 pkg_type="$1"
diff --git a/tools/rapids-download-from-github b/tools/rapids-download-from-github
index 5b6feef..f622a19 100755
--- a/tools/rapids-download-from-github
+++ b/tools/rapids-download-from-github
@@ -6,11 +6,13 @@
 set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-from-github"
 
-if [ -z "$1" ]; then
+if [ -z "${1:-}" ]; then
   rapids-echo-stderr "Must specify input arguments: PKG_NAME"
   exit 1
 fi
 
+source rapids-prompt-local-github-auth
+
 github_run_id="$(rapids-github-run-id)"
 pkg_name="$1"
 unzip_dest="${RAPIDS_UNZIP_DIR:-$(mktemp -d)}"
diff --git a/tools/rapids-download-wheels-from-github b/tools/rapids-download-wheels-from-github
index e2e59d2..1eb8d71 100755
--- a/tools/rapids-download-wheels-from-github
+++ b/tools/rapids-download-wheels-from-github
@@ -8,7 +8,6 @@ set -eo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-download-wheels-from-github"
 
 source rapids-prompt-local-repo-config
-source rapids-prompt-local-github-auth
 
 # Validate package type argument
 pkg_type="$1"
diff --git a/tools/rapids-prompt-local-github-auth b/tools/rapids-prompt-local-github-auth
index d151897..58b5b9e 100755
--- a/tools/rapids-prompt-local-github-auth
+++ b/tools/rapids-prompt-local-github-auth
@@ -1,9 +1,30 @@
 #!/bin/bash
-# A utility script that prompts user to authenticate with GitHub in
-# local environments
+#
+# Checks if the current environment is authenticated to communicate with the GitHub API.
+#
+# If not, prompts for an interactive login to generate short-lived credentials.
+#
+# This exists primarily for interactive use cases, like trying to reproduce CI locally.
+#
 
-if [ -z "${GH_TOKEN:-}" ] && [ -z "${GITHUB_TOKEN:-}" ]; then
-  rapids-echo-stderr "No GitHub token detected in environment"
-  rapids-echo-stderr "Please authenticate with GitHub to continue"
-  gh auth login --web --git-protocol https
+if ! gh auth status >/dev/null 2>&1; then
+    rapids-echo-stderr "No GitHub authentication detected."
+    rapids-echo-stderr "Please authenticate with GitHub to continue."
+    rapids-echo-stderr "To avoid these interactive prompts in the future, set environment variable 'GH_TOKEN' or run 'gh auth login' with the GitHub CLI."
+
+    # Prompt for interactive login.
+    #
+    # By omitting --scopes, this will generate a short-lived GitHub auth token
+    # with only the minimum required scopes.
+    #
+    # You can run 'gh auth status' afterwards to check the scopes the GitHub CLI granted.
+    if ! gh auth login \
+        --web \
+        --git-protocol https \
+        --hostname "github.com" \
+        --skip-ssh-key;
+    then
+        rapids-echo-stderr "GitHub authentication failed. Exiting.";
+        exit 1;
+    fi
 fi

From dc6cf97d7b8d3c3ae5b56c57563ef4795669b7ff Mon Sep 17 00:00:00 2001
From: James Lamb <jlamb@nvidia.com>
Date: Thu, 8 May 2025 16:26:19 -0500
Subject: [PATCH 2/2] one more place that needs it

---
 tools/rapids-github-run-id | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/rapids-github-run-id b/tools/rapids-github-run-id
index c9b85f7..49ed289 100755
--- a/tools/rapids-github-run-id
+++ b/tools/rapids-github-run-id
@@ -5,6 +5,8 @@
 set -euo pipefail
 export RAPIDS_SCRIPT_NAME="rapids-github-run-id"
 
+source rapids-prompt-local-github-auth
+
 # While called by CI, all the environment variables are set by the caller. However when run locally, these environment variables are set by rapids-prompt-local-repo-config
 case "${RAPIDS_BUILD_TYPE}" in
   pull-request)