Skip to content

Commit ccb313e

Browse files
skulidropekskulidropek
committed
fix(shell): align clone and gh auth with labeled tokens
1 parent df243c3 commit ccb313e

File tree

7 files changed

+74
-23
lines changed

7 files changed

+74
-23
lines changed

‎packages/app/src/docker-git/cli/parser-clone.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ const applyCloneDefaults = (
1818
...raw,
1919
repoUrl: rawRepoUrl,
2020
outDir: raw.outDir ?? `.docker-git/${repoPath}`,
21-
targetDir: raw.targetDir ?? `${targetHome}/.docker-git/workspaces/${repoPath}`
21+
targetDir: raw.targetDir ?? `${targetHome}/workspaces/${repoPath}`
2222
}
2323
}
2424

‎packages/app/src/docker-git/cli/usage.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ Commands:
3434
Options:
3535
--repo-ref <ref> Git ref/branch (default: main)
3636
--branch, -b <ref> Alias for --repo-ref
37-
--target-dir <path> Target dir inside container (create default: /home/dev/app, clone default: ~/.docker-git/workspaces/<org>/<repo>[/issue-<id>|/pr-<id>])
37+
--target-dir <path> Target dir inside container (create default: /home/dev/app, clone default: ~/workspaces/<org>/<repo>[/issue-<id>|/pr-<id>])
3838
--ssh-port <port> Local SSH port (default: 2222)
3939
--ssh-user <user> SSH user inside container (default: dev)
4040
--container-name <name> Docker container name (default: dg-<repo>)

‎packages/app/tests/docker-git/entrypoint-auth.test.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,19 @@ describe("renderEntrypoint auth bridge", () => {
1717
"GIT_AUTH_TOKEN=\"${GIT_AUTH_TOKEN:-${GITHUB_TOKEN:-${GH_TOKEN:-}}}\""
1818
)
1919
expect(entrypoint).toContain("GITHUB_TOKEN=\"${GITHUB_TOKEN:-${GH_TOKEN:-}}\"")
20-
expect(entrypoint).toContain("if [[ -n \"$GH_TOKEN\" || -n \"$GITHUB_TOKEN\" ]]; then")
20+
expect(entrypoint).toContain("AUTH_LABEL_RAW=\"${GIT_AUTH_LABEL:-${GITHUB_AUTH_LABEL:-}}\"")
21+
expect(entrypoint).toContain("LABELED_GITHUB_TOKEN_KEY=\"GITHUB_TOKEN__$RESOLVED_AUTH_LABEL\"")
22+
expect(entrypoint).toContain("LABELED_GIT_TOKEN_KEY=\"GIT_AUTH_TOKEN__$RESOLVED_AUTH_LABEL\"")
23+
expect(entrypoint).toContain("if [[ -n \"$EFFECTIVE_GH_TOKEN\" ]]; then")
2124
expect(entrypoint).toContain(String.raw`printf "export GITHUB_TOKEN=%q\n" "$EFFECTIVE_GITHUB_TOKEN"`)
25+
expect(entrypoint).toContain(String.raw`printf "export GH_TOKEN=%q\n" "$EFFECTIVE_GH_TOKEN"`)
26+
expect(entrypoint).toContain(String.raw`printf "export GIT_AUTH_TOKEN=%q\n" "$EFFECTIVE_GITHUB_TOKEN"`)
2227
expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GITHUB_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
28+
expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GH_TOKEN\" \"$EFFECTIVE_GH_TOKEN\"")
29+
expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GIT_AUTH_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
2330
expect(entrypoint).toContain("GIT_CREDENTIAL_HELPER_PATH=\"/usr/local/bin/docker-git-credential-helper\"")
24-
expect(entrypoint).toContain("token=\"$GITHUB_TOKEN\"")
25-
expect(entrypoint).toContain("token=\"$GH_TOKEN\"")
31+
expect(entrypoint).toContain("token=\"${GITHUB_TOKEN:-}\"")
32+
expect(entrypoint).toContain("token=\"${GH_TOKEN:-}\"")
2633
expect(entrypoint).toContain(String.raw`printf "%s\n" "password=$token"`)
2734
expect(entrypoint).toContain("git config --global credential.helper")
2835
}))

‎packages/app/tests/docker-git/parser.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ describe("parseArgs", () => {
8787
expect(command.openSsh).toBe(true)
8888
expect(command.waitForClone).toBe(true)
8989
expect(command.config.targetDir).toBe(
90-
expandDefaultTargetDir("~/.docker-git/workspaces/org/repo")
90+
expandDefaultTargetDir("~/workspaces/org/repo")
9191
)
9292
}))
9393

@@ -129,7 +129,7 @@ describe("parseArgs", () => {
129129
expect(command.config.repoRef).toBe("vova-fork")
130130
expect(command.outDir).toBe(".docker-git/agiens/crm")
131131
expect(command.config.targetDir).toBe(
132-
expandDefaultTargetDir("~/.docker-git/workspaces/agiens/crm")
132+
expandDefaultTargetDir("~/workspaces/agiens/crm")
133133
)
134134
}))
135135

@@ -139,7 +139,7 @@ describe("parseArgs", () => {
139139
expect(command.config.repoRef).toBe("issue-5")
140140
expect(command.outDir).toBe(".docker-git/org/repo/issue-5")
141141
expect(command.config.targetDir).toBe(
142-
expandDefaultTargetDir("~/.docker-git/workspaces/org/repo/issue-5")
142+
expandDefaultTargetDir("~/workspaces/org/repo/issue-5")
143143
)
144144
expect(command.config.containerName).toBe("dg-repo-issue-5")
145145
expect(command.config.serviceName).toBe("dg-repo-issue-5")
@@ -152,7 +152,7 @@ describe("parseArgs", () => {
152152
expect(command.config.repoRef).toBe("refs/pull/42/head")
153153
expect(command.outDir).toBe(".docker-git/org/repo/pr-42")
154154
expect(command.config.targetDir).toBe(
155-
expandDefaultTargetDir("~/.docker-git/workspaces/org/repo/pr-42")
155+
expandDefaultTargetDir("~/workspaces/org/repo/pr-42")
156156
)
157157
expect(command.config.containerName).toBe("dg-repo-pr-42")
158158
expect(command.config.serviceName).toBe("dg-repo-pr-42")

‎packages/docker-git/tests/core/templates.test.ts‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,13 @@ describe("planFiles", () => {
7272
expect(entrypointSpec.contents).toContain(
7373
"GIT_CREDENTIAL_HELPER_PATH=\"/usr/local/bin/docker-git-credential-helper\""
7474
)
75-
expect(entrypointSpec.contents).toContain("token=\"$GITHUB_TOKEN\"")
75+
expect(entrypointSpec.contents).toContain("AUTH_LABEL_RAW=\"${GIT_AUTH_LABEL:-${GITHUB_AUTH_LABEL:-}}\"")
76+
expect(entrypointSpec.contents).toContain("LABELED_GITHUB_TOKEN_KEY=\"GITHUB_TOKEN__$RESOLVED_AUTH_LABEL\"")
77+
expect(entrypointSpec.contents).toContain("LABELED_GIT_TOKEN_KEY=\"GIT_AUTH_TOKEN__$RESOLVED_AUTH_LABEL\"")
78+
expect(entrypointSpec.contents).toContain("SAFE_GH_TOKEN=\"$(printf \"%q\" \"$EFFECTIVE_GH_TOKEN\")\"")
79+
expect(entrypointSpec.contents).toContain("docker_git_upsert_ssh_env \"GIT_AUTH_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
80+
expect(entrypointSpec.contents).toContain("token=\"${GITHUB_TOKEN:-}\"")
81+
expect(entrypointSpec.contents).toContain("token=\"${GH_TOKEN:-}\"")
7682
expect(entrypointSpec.contents).toContain("issue_managed_start='<!-- docker-git:issue-managed:start -->'")
7783
expect(entrypointSpec.contents).toContain("check_issue_managed_block_range")
7884
expect(entrypointSpec.contents).toContain(
@@ -90,6 +96,8 @@ describe("planFiles", () => {
9096
expect(entrypointSpec.contents).toContain("[clone-cache] using mirror: $CACHE_REPO_DIR")
9197
expect(entrypointSpec.contents).toContain("git clone --progress $CLONE_CACHE_ARGS")
9298
expect(entrypointSpec.contents).toContain("[clone-cache] mirror created: $CACHE_REPO_DIR")
99+
expect(entrypointSpec.contents).toContain("CACHE_REPO_DIR=\"${CACHE_REPO_DIR:-}\"")
100+
expect(entrypointSpec.contents).toContain("fetch --progress --prune '$AUTH_REPO_URL' '+refs/*:refs/*'")
93101
}
94102
}))
95103

‎packages/lib/src/core/templates-entrypoint/git.ts‎

Lines changed: 46 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,60 @@
11
import type { TemplateConfig } from "../domain.js"
22

33
const renderEntrypointAuthEnvBridge = (config: TemplateConfig): string =>
4-
String.raw`# 2) Ensure GitHub auth vars are available for SSH sessions if provided
5-
if [[ -n "$GH_TOKEN" || -n "$GITHUB_TOKEN" ]]; then
6-
EFFECTIVE_GITHUB_TOKEN="$GITHUB_TOKEN"
7-
if [[ -z "$EFFECTIVE_GITHUB_TOKEN" ]]; then
8-
EFFECTIVE_GITHUB_TOKEN="$GH_TOKEN"
4+
String.raw`# 2) Ensure GitHub auth vars are available for SSH sessions.
5+
# Prefer a label-selected token (same selection model as clone/create) when present.
6+
RESOLVED_AUTH_LABEL=""
7+
AUTH_LABEL_RAW="${"${"}GIT_AUTH_LABEL:-${"${"}GITHUB_AUTH_LABEL:-}}"
8+
9+
if [[ -z "$AUTH_LABEL_RAW" && "$REPO_URL" == https://github.com/* ]]; then
10+
AUTH_LABEL_RAW="$(printf "%s" "$REPO_URL" | sed -E 's#^https://github.com/##; s#[.]git$##; s#/*$##' | cut -d/ -f1)"
11+
fi
12+
13+
if [[ -n "$AUTH_LABEL_RAW" ]]; then
14+
RESOLVED_AUTH_LABEL="$(printf "%s" "$AUTH_LABEL_RAW" | tr '[:lower:]' '[:upper:]' | sed -E 's/[^A-Z0-9]+/_/g; s/^_+//; s/_+$//')"
15+
if [[ "$RESOLVED_AUTH_LABEL" == "DEFAULT" ]]; then
16+
RESOLVED_AUTH_LABEL=""
917
fi
18+
fi
1019
11-
EFFECTIVE_GH_TOKEN="$GH_TOKEN"
12-
if [[ -z "$EFFECTIVE_GH_TOKEN" ]]; then
13-
EFFECTIVE_GH_TOKEN="$EFFECTIVE_GITHUB_TOKEN"
20+
EFFECTIVE_GITHUB_TOKEN="$GITHUB_TOKEN"
21+
if [[ -z "$EFFECTIVE_GITHUB_TOKEN" ]]; then
22+
EFFECTIVE_GITHUB_TOKEN="$GH_TOKEN"
23+
fi
24+
if [[ -z "$EFFECTIVE_GITHUB_TOKEN" ]]; then
25+
EFFECTIVE_GITHUB_TOKEN="$GIT_AUTH_TOKEN"
26+
fi
27+
28+
if [[ -n "$RESOLVED_AUTH_LABEL" ]]; then
29+
LABELED_GIT_TOKEN_KEY="GIT_AUTH_TOKEN__$RESOLVED_AUTH_LABEL"
30+
LABELED_GITHUB_TOKEN_KEY="GITHUB_TOKEN__$RESOLVED_AUTH_LABEL"
31+
LABELED_GH_TOKEN_KEY="GH_TOKEN__$RESOLVED_AUTH_LABEL"
32+
33+
LABELED_GIT_TOKEN="${"${"}!LABELED_GIT_TOKEN_KEY-}"
34+
LABELED_GITHUB_TOKEN="${"${"}!LABELED_GITHUB_TOKEN_KEY-}"
35+
LABELED_GH_TOKEN="${"${"}!LABELED_GH_TOKEN_KEY-}"
36+
37+
if [[ -n "$LABELED_GIT_TOKEN" ]]; then
38+
EFFECTIVE_GITHUB_TOKEN="$LABELED_GIT_TOKEN"
39+
elif [[ -n "$LABELED_GITHUB_TOKEN" ]]; then
40+
EFFECTIVE_GITHUB_TOKEN="$LABELED_GITHUB_TOKEN"
41+
elif [[ -n "$LABELED_GH_TOKEN" ]]; then
42+
EFFECTIVE_GITHUB_TOKEN="$LABELED_GH_TOKEN"
1443
fi
44+
fi
45+
46+
EFFECTIVE_GH_TOKEN="$EFFECTIVE_GITHUB_TOKEN"
1547
48+
if [[ -n "$EFFECTIVE_GH_TOKEN" ]]; then
1649
printf "export GH_TOKEN=%q\n" "$EFFECTIVE_GH_TOKEN" > /etc/profile.d/gh-token.sh
1750
printf "export GITHUB_TOKEN=%q\n" "$EFFECTIVE_GITHUB_TOKEN" >> /etc/profile.d/gh-token.sh
51+
printf "export GIT_AUTH_TOKEN=%q\n" "$EFFECTIVE_GITHUB_TOKEN" >> /etc/profile.d/gh-token.sh
1852
chmod 0644 /etc/profile.d/gh-token.sh
1953
docker_git_upsert_ssh_env "GH_TOKEN" "$EFFECTIVE_GH_TOKEN"
2054
docker_git_upsert_ssh_env "GITHUB_TOKEN" "$EFFECTIVE_GITHUB_TOKEN"
55+
docker_git_upsert_ssh_env "GIT_AUTH_TOKEN" "$EFFECTIVE_GITHUB_TOKEN"
2156
22-
SAFE_GH_TOKEN="$(printf "%q" "$GH_TOKEN")"
57+
SAFE_GH_TOKEN="$(printf "%q" "$EFFECTIVE_GH_TOKEN")"
2358
# Keep git+https auth in sync with gh auth so push/pull works without manual setup.
2459
su - ${config.sshUser} -c "GH_TOKEN=$SAFE_GH_TOKEN gh auth setup-git --hostname github.com --force" || true
2560
@@ -47,9 +82,9 @@ if [[ "$#" -lt 1 || "$1" != "get" ]]; then
4782
exit 0
4883
fi
4984
50-
token="$GITHUB_TOKEN"
85+
token="${"${"}GITHUB_TOKEN:-}"
5186
if [[ -z "$token" ]]; then
52-
token="$GH_TOKEN"
87+
token="${"${"}GH_TOKEN:-}"
5388
fi
5489
5590
if [[ -z "$token" ]]; then

‎packages/lib/src/core/templates-entrypoint/tasks.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ else
101101
chown 1000:1000 "$CACHE_ROOT" || true
102102
if [[ -d "$CACHE_REPO_DIR" ]]; then
103103
if su - ${config.sshUser} -c "git --git-dir '$CACHE_REPO_DIR' rev-parse --is-bare-repository >/dev/null 2>&1"; then
104-
if ! su - ${config.sshUser} -c "GIT_TERMINAL_PROMPT=0 git --git-dir '$CACHE_REPO_DIR' fetch --progress --prune '$REPO_URL' '+refs/*:refs/*'"; then
104+
if ! su - ${config.sshUser} -c "GIT_TERMINAL_PROMPT=0 git --git-dir '$CACHE_REPO_DIR' fetch --progress --prune '$AUTH_REPO_URL' '+refs/*:refs/*'"; then
105105
echo "[clone-cache] mirror refresh failed for $REPO_URL"
106106
fi
107107
CLONE_CACHE_ARGS="--reference-if-able '$CACHE_REPO_DIR' --dissociate"
@@ -155,7 +155,8 @@ const renderCloneBodyRef = (config: TemplateConfig): string =>
155155
fi`
156156

157157
const renderCloneCacheFinalize = (config: TemplateConfig): string =>
158-
`if [[ "$CLONE_OK" -eq 1 && -d "$TARGET_DIR/.git" && -n "$CACHE_REPO_DIR" && ! -d "$CACHE_REPO_DIR" ]]; then
158+
`CACHE_REPO_DIR="\${CACHE_REPO_DIR:-}"
159+
if [[ "$CLONE_OK" -eq 1 && -d "$TARGET_DIR/.git" && -n "$CACHE_REPO_DIR" && ! -d "$CACHE_REPO_DIR" ]]; then
159160
CACHE_TMP_DIR="$CACHE_REPO_DIR.tmp-$$"
160161
if su - ${config.sshUser} -c "rm -rf '$CACHE_TMP_DIR' && GIT_TERMINAL_PROMPT=0 git clone --mirror --progress '$TARGET_DIR/.git' '$CACHE_TMP_DIR'"; then
161162
if mv "$CACHE_TMP_DIR" "$CACHE_REPO_DIR" 2>/dev/null; then

0 commit comments

Comments
 (0)