Skip to content

update handling of GitHub auth for local, interactive use #172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jameslamb merged 3 commits into from
May 8, 2025
Merged

update handling of GitHub auth for local, interactive use #172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ed0e7f2
update handling of GitHub auth for local, interactive use
jameslamb May 8, 2025
dc6cf97
one more place that needs it
jameslamb May 8, 2025
504a871
Merge branch 'main' into gh-artifacts/local-repro
jameslamb May 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions tools/_rapids-get-pr-artifact-github
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ if [[ "${package_format}" = "wheel" && -z "${RAPIDS_PY_WHEEL_NAME:+placeholder}"
exit 1
fi

source rapids-prompt-local-github-auth

@bdice bdice May 8, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes! I came to this conclusion too: #171 (comment)

@jameslamb jameslamb May 8, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah! Everywhere that we invoke gh in a tool that might be used interactively, this should be called.

The if gh auth status makes it idempotent (ensures you aren't put through the interactive login workflow multiple times).


# If commit is not provided, get the latest commit on the PR
if [[ -z "${commit}" ]]; then
commit=$(rapids-retry --quiet gh pr view "${pr}" --repo rapidsai/"${repo}" --json headRefOid --jq '.headRefOid')
Expand Down
1 change: 0 additions & 1 deletion tools/rapids-download-conda-from-github
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ set -euo pipefail
export RAPIDS_SCRIPT_NAME="rapids-download-conda-from-github"

source rapids-prompt-local-repo-config
source rapids-prompt-local-github-auth

@jameslamb jameslamb May 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing this because this script doesn't directly call the gh CLI. These rapids-prompt-local-github-auth calls should only be placed in scripts that directly need GitHub auth, to minimize unnecessary calls.

Found those like this:

git grep 'gh '


# Validate package type argument
pkg_type="$1"
Expand Down
4 changes: 3 additions & 1 deletion tools/rapids-download-from-github
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@
set -euo pipefail
export RAPIDS_SCRIPT_NAME="rapids-download-from-github"

if [ -z "$1" ]; then
if [ -z "${1:-}" ]; then

@jameslamb jameslamb May 8, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The use of set -u a few lines up means that if you fail to pass any arguments to this script, it never gets through this if and emits the informative error message. Defaulting back to null if ${1} is undefined fixes that.

rapids-download-from-github
# tools/rapids-download-from-github: line 9: $1: unbound variable

@bdice bdice May 8, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I observed this too and didn’t realize it was a bug. 🥲

@jameslamb jameslamb May 8, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ha yup! Same thing as conda-forge/arrow-cpp-feedstock#1696, it's easy to trip over stuff like this with set -u.

rapids-echo-stderr "Must specify input arguments: PKG_NAME"
exit 1
fi

source rapids-prompt-local-github-auth

github_run_id="$(rapids-github-run-id)"
pkg_name="$1"
unzip_dest="${RAPIDS_UNZIP_DIR:-$(mktemp -d)}"
Expand Down
1 change: 0 additions & 1 deletion tools/rapids-download-wheels-from-github
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ set -eo pipefail
export RAPIDS_SCRIPT_NAME="rapids-download-wheels-from-github"

source rapids-prompt-local-repo-config
source rapids-prompt-local-github-auth

# Validate package type argument
pkg_type="$1"
Expand Down
2 changes: 2 additions & 0 deletions tools/rapids-github-run-id
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
set -euo pipefail
export RAPIDS_SCRIPT_NAME="rapids-github-run-id"

source rapids-prompt-local-github-auth

# While called by CI, all the environment variables are set by the caller. However when run locally, these environment variables are set by rapids-prompt-local-repo-config
case "${RAPIDS_BUILD_TYPE}" in
pull-request)
Expand Down
32 changes: 26 additions & 6 deletions tools/rapids-prompt-local-github-auth
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,30 @@
#!/bin/bash
#
# A utility script that prompts user to authenticate with GitHub in
# local environments
# Checks if the current environment is authenticated to communicate with the GitHub API.
#
# If not, prompts for an interactive login to generate short-lived credentials.
#
# This exists primarily for interactive use cases, like trying to reproduce CI locally.
#

if ! gh auth status >/dev/null 2>&1; then
rapids-echo-stderr "No GitHub authentication detected."
rapids-echo-stderr "Please authenticate with GitHub to continue."
rapids-echo-stderr "To avoid these interactive prompts in the future, set environment variable 'GH_TOKEN' or run 'gh auth login' with the GitHub CLI."

if [ -z "${GH_TOKEN:-}" ] && [ -z "${GITHUB_TOKEN:-}" ]; then
rapids-echo-stderr "No GitHub token detected in environment"
rapids-echo-stderr "Please authenticate with GitHub to continue"
gh auth login --web --git-protocol https
# Prompt for interactive login.
#
# By omitting --scopes, this will generate a short-lived GitHub auth token
# with only the minimum required scopes.
#
# You can run 'gh auth status' afterwards to check the scopes the GitHub CLI granted.
if ! gh auth login \
--web \
--git-protocol https \
--hostname "github.com" \
--skip-ssh-key;
then
rapids-echo-stderr "GitHub authentication failed. Exiting.";
exit 1;
fi
fi