attestation: only extract credentials when necessary

This commit is contained in:
Bo Anderson 2024-07-30 04:51:29 +01:00
parent a0a3333ee4
commit 1b8a8a0902
No known key found for this signature in database

View File

@ -59,11 +59,11 @@ module Homebrew
def self.enabled?
return false if Homebrew::EnvConfig.no_verify_attestations?
return true if Homebrew::EnvConfig.verify_attestations?
return false if GitHub::API.credentials.blank?
return false if ENV.fetch("CI", false)
return false if OS.unsupported_configuration?
Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?
# Always check credentials last to avoid unnecessary credential extraction.
(Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?) && GitHub::API.credentials.present?
end
# Returns a path to a suitable `gh` executable for attestation verification.