45978435e7
- Previously I thought that comments were fine to discourage people from wasting their time trying to bump things that used `undef` that Sorbet didn't support. But RuboCop is better at this since it'll complain if the comments are unnecessary. - Suggested in https://github.com/Homebrew/brew/pull/18018#issuecomment-2283369501. - I've gone for a mixture of `rubocop:disable` for the files that can't be `typed: strict` (use of undef, required before everything else, etc) and `rubocop:todo` for everything else that should be tried to make strictly typed. There's no functional difference between the two as `rubocop:todo` is `rubocop:disable` with a different name. - And I entirely disabled the cop for the docs/ directory since `typed: strict` isn't going to gain us anything for some Markdown linting config files. - This means that now it's easier to track what needs to be done rather than relying on checklists of files in our big Sorbet issue: ```shell $ git grep 'typed: true # rubocop:todo Sorbet/StrictSigil' | wc -l 268 ``` - And this is confirmed working for new files: ```shell $ git status On branch use-rubocop-for-sorbet-strict-sigils Untracked files: (use "git add <file>..." to include in what will be committed) Library/Homebrew/bad.rb Library/Homebrew/good.rb nothing added to commit but untracked files present (use "git add" to track) $ brew style Offenses: bad.rb:1:1: C: Sorbet/StrictSigil: Sorbet sigil should be at least strict got true. ^^^^^^^^^^^^^ 1340 files inspected, 1 offense detected ```
413 lines
14 KiB
Ruby
413 lines
14 KiB
Ruby
# typed: true # rubocop:todo Sorbet/StrictSigil
|
|
# frozen_string_literal: true
|
|
|
|
require "system_command"
|
|
|
|
module GitHub
|
|
def self.pat_blurb(scopes = ALL_SCOPES)
|
|
require "utils/formatter"
|
|
require "utils/shell"
|
|
<<~EOS
|
|
Create a GitHub personal access token:
|
|
#{Formatter.url(
|
|
"https://github.com/settings/tokens/new?scopes=#{scopes.join(",")}&description=Homebrew",
|
|
)}
|
|
#{Utils::Shell.set_variable_in_profile("HOMEBREW_GITHUB_API_TOKEN", "your_token_here")}
|
|
EOS
|
|
end
|
|
|
|
API_URL = "https://api.github.com"
|
|
API_MAX_PAGES = 50
|
|
private_constant :API_MAX_PAGES
|
|
API_MAX_ITEMS = 5000
|
|
private_constant :API_MAX_ITEMS
|
|
PAGINATE_RETRY_COUNT = 3
|
|
private_constant :PAGINATE_RETRY_COUNT
|
|
|
|
CREATE_GIST_SCOPES = ["gist"].freeze
|
|
CREATE_ISSUE_FORK_OR_PR_SCOPES = ["repo"].freeze
|
|
CREATE_WORKFLOW_SCOPES = ["workflow"].freeze
|
|
ALL_SCOPES = (CREATE_GIST_SCOPES + CREATE_ISSUE_FORK_OR_PR_SCOPES + CREATE_WORKFLOW_SCOPES).freeze
|
|
private_constant :ALL_SCOPES
|
|
GITHUB_PERSONAL_ACCESS_TOKEN_REGEX = /^(?:[a-f0-9]{40}|(?:gh[pousr]|github_pat)_\w{36,251})$/
|
|
private_constant :GITHUB_PERSONAL_ACCESS_TOKEN_REGEX
|
|
|
|
# Helper functions for accessing the GitHub API.
|
|
#
|
|
# @api internal
|
|
module API
|
|
extend SystemCommand::Mixin
|
|
|
|
# Generic API error.
|
|
class Error < RuntimeError
|
|
attr_reader :github_message
|
|
end
|
|
|
|
# Error when the requested URL is not found.
|
|
class HTTPNotFoundError < Error
|
|
def initialize(github_message)
|
|
@github_message = github_message
|
|
super
|
|
end
|
|
end
|
|
|
|
# Error when the API rate limit is exceeded.
|
|
class RateLimitExceededError < Error
|
|
def initialize(reset, github_message)
|
|
@github_message = github_message
|
|
new_pat_message = ", or:\n#{GitHub.pat_blurb}" if API.credentials.blank?
|
|
super <<~EOS
|
|
GitHub API Error: #{github_message}
|
|
Try again in #{pretty_ratelimit_reset(reset)}#{new_pat_message}
|
|
EOS
|
|
end
|
|
|
|
def pretty_ratelimit_reset(reset)
|
|
pretty_duration(Time.at(reset) - Time.now)
|
|
end
|
|
end
|
|
|
|
GITHUB_IP_ALLOWLIST_ERROR = Regexp.new("Although you appear to have the correct authorization credentials, " \
|
|
"the `(.+)` organization has an IP allow list enabled, " \
|
|
"and your IP address is not permitted to access this resource").freeze
|
|
|
|
NO_CREDENTIALS_MESSAGE = <<~MESSAGE.freeze
|
|
No GitHub credentials found in macOS Keychain, GitHub CLI or the environment.
|
|
#{GitHub.pat_blurb}
|
|
MESSAGE
|
|
|
|
# Error when authentication fails.
|
|
class AuthenticationFailedError < Error
|
|
def initialize(credentials_type, github_message)
|
|
@github_message = github_message
|
|
message = +"GitHub API Error: #{github_message}\n"
|
|
message << case credentials_type
|
|
when :github_cli_token
|
|
<<~EOS
|
|
Your GitHub CLI login session may be invalid.
|
|
Refresh it with:
|
|
gh auth login --hostname github.com
|
|
EOS
|
|
when :keychain_username_password
|
|
<<~EOS
|
|
The GitHub credentials in the macOS keychain may be invalid.
|
|
Clear them with:
|
|
printf "protocol=https\\nhost=github.com\\n" | git credential-osxkeychain erase
|
|
EOS
|
|
when :env_token
|
|
require "utils/formatter"
|
|
<<~EOS
|
|
HOMEBREW_GITHUB_API_TOKEN may be invalid or expired; check:
|
|
#{Formatter.url("https://github.com/settings/tokens")}
|
|
EOS
|
|
when :none
|
|
NO_CREDENTIALS_MESSAGE
|
|
end
|
|
super message.freeze
|
|
end
|
|
end
|
|
|
|
# Error when the user has no GitHub API credentials set at all (macOS keychain, GitHub CLI or envvar).
|
|
class MissingAuthenticationError < Error
|
|
def initialize
|
|
super NO_CREDENTIALS_MESSAGE
|
|
end
|
|
end
|
|
|
|
# Error when the API returns a validation error.
|
|
class ValidationFailedError < Error
|
|
def initialize(github_message, errors)
|
|
@github_message = if errors.empty?
|
|
github_message
|
|
else
|
|
"#{github_message}: #{errors}"
|
|
end
|
|
|
|
super(@github_message)
|
|
end
|
|
end
|
|
|
|
ERRORS = [
|
|
AuthenticationFailedError,
|
|
HTTPNotFoundError,
|
|
RateLimitExceededError,
|
|
Error,
|
|
JSON::ParserError,
|
|
].freeze
|
|
|
|
sig { returns(T.nilable(String)) }
|
|
private_class_method def self.uid_home
|
|
require "etc"
|
|
Etc.getpwuid(Process.uid)&.dir
|
|
rescue ArgumentError
|
|
# Cover for misconfigured NSS setups
|
|
nil
|
|
end
|
|
|
|
# Gets the token from the GitHub CLI for github.com.
|
|
sig { returns(T.nilable(String)) }
|
|
def self.github_cli_token
|
|
require "utils/uid"
|
|
Utils::UID.drop_euid do
|
|
# Avoid `Formula["gh"].opt_bin` so this method works even with `HOMEBREW_DISABLE_LOAD_FORMULA`.
|
|
env = {
|
|
"PATH" => PATH.new(HOMEBREW_PREFIX/"opt/gh/bin", ENV.fetch("PATH")),
|
|
"HOME" => uid_home,
|
|
}.compact
|
|
gh_out, _, result = system_command "gh",
|
|
args: ["auth", "token", "--hostname", "github.com"],
|
|
env:,
|
|
print_stderr: false
|
|
return unless result.success?
|
|
|
|
gh_out.chomp
|
|
end
|
|
end
|
|
|
|
# Gets the password field from `git-credential-osxkeychain` for github.com,
|
|
# but only if that password looks like a GitHub Personal Access Token.
|
|
sig { returns(T.nilable(String)) }
|
|
def self.keychain_username_password
|
|
require "utils/uid"
|
|
Utils::UID.drop_euid do
|
|
git_credential_out, _, result = system_command "git",
|
|
args: ["credential-osxkeychain", "get"],
|
|
input: ["protocol=https\n", "host=github.com\n"],
|
|
env: { "HOME" => uid_home }.compact,
|
|
print_stderr: false
|
|
return unless result.success?
|
|
|
|
git_credential_out.force_encoding("ASCII-8BIT")
|
|
github_username = git_credential_out[/^username=(.+)/, 1]
|
|
github_password = git_credential_out[/^password=(.+)/, 1]
|
|
return unless github_username
|
|
|
|
# Don't use passwords from the keychain unless they look like
|
|
# GitHub Personal Access Tokens:
|
|
# https://github.com/Homebrew/brew/issues/6862#issuecomment-572610344
|
|
return unless GITHUB_PERSONAL_ACCESS_TOKEN_REGEX.match?(github_password)
|
|
|
|
github_password
|
|
end
|
|
end
|
|
|
|
def self.credentials
|
|
@credentials ||= Homebrew::EnvConfig.github_api_token.presence
|
|
@credentials ||= github_cli_token.presence
|
|
@credentials ||= keychain_username_password.presence
|
|
end
|
|
|
|
sig { returns(Symbol) }
|
|
def self.credentials_type
|
|
if Homebrew::EnvConfig.github_api_token.present?
|
|
:env_token
|
|
elsif github_cli_token.present?
|
|
:github_cli_token
|
|
elsif keychain_username_password.present?
|
|
:keychain_username_password
|
|
else
|
|
:none
|
|
end
|
|
end
|
|
|
|
CREDENTIAL_NAMES = {
|
|
env_token: "HOMEBREW_GITHUB_API_TOKEN",
|
|
github_cli_token: "GitHub CLI login",
|
|
keychain_username_password: "macOS Keychain GitHub",
|
|
}.freeze
|
|
|
|
# Given an API response from GitHub, warn the user if their credentials
|
|
# have insufficient permissions.
|
|
def self.credentials_error_message(response_headers, needed_scopes)
|
|
return if response_headers.empty?
|
|
|
|
scopes = response_headers["x-accepted-oauth-scopes"].to_s.split(", ")
|
|
needed_scopes = Set.new(scopes || needed_scopes)
|
|
credentials_scopes = response_headers["x-oauth-scopes"]
|
|
return if needed_scopes.subset?(Set.new(credentials_scopes.to_s.split(", ")))
|
|
|
|
github_permission_link = GitHub.pat_blurb(needed_scopes.to_a)
|
|
needed_scopes = needed_scopes.to_a.join(", ").presence || "none"
|
|
credentials_scopes = "none" if credentials_scopes.blank?
|
|
|
|
what = CREDENTIAL_NAMES.fetch(credentials_type)
|
|
@credentials_error_message ||= onoe <<~EOS
|
|
Your #{what} credentials do not have sufficient scope!
|
|
Scopes required: #{needed_scopes}
|
|
Scopes present: #{credentials_scopes}
|
|
#{github_permission_link}
|
|
EOS
|
|
end
|
|
|
|
def self.open_rest(
|
|
url, data: nil, data_binary_path: nil, request_method: nil, scopes: [].freeze, parse_json: true
|
|
)
|
|
# This is a no-op if the user is opting out of using the GitHub API.
|
|
return block_given? ? yield({}) : {} if Homebrew::EnvConfig.no_github_api?
|
|
|
|
# This is a Curl format token, not a Ruby one.
|
|
# rubocop:disable Style/FormatStringToken
|
|
args = ["--header", "Accept: application/vnd.github+json", "--write-out", "\n%{http_code}"]
|
|
# rubocop:enable Style/FormatStringToken
|
|
|
|
token = credentials
|
|
args += ["--header", "Authorization: token #{token}"] if credentials_type != :none
|
|
args += ["--header", "X-GitHub-Api-Version:2022-11-28"]
|
|
|
|
require "tempfile"
|
|
data_tmpfile = nil
|
|
if data
|
|
begin
|
|
data = JSON.pretty_generate data
|
|
data_tmpfile = Tempfile.new("github_api_post", HOMEBREW_TEMP)
|
|
rescue JSON::ParserError => e
|
|
raise Error, "Failed to parse JSON request:\n#{e.message}\n#{data}", e.backtrace
|
|
end
|
|
end
|
|
|
|
if data_binary_path.present?
|
|
args += ["--data-binary", "@#{data_binary_path}"]
|
|
args += ["--header", "Content-Type: application/gzip"]
|
|
end
|
|
|
|
headers_tmpfile = Tempfile.new("github_api_headers", HOMEBREW_TEMP)
|
|
begin
|
|
if data_tmpfile
|
|
data_tmpfile.write data
|
|
data_tmpfile.close
|
|
args += ["--data", "@#{data_tmpfile.path}"]
|
|
|
|
args += ["--request", request_method.to_s] if request_method
|
|
end
|
|
|
|
args += ["--dump-header", T.must(headers_tmpfile.path)]
|
|
|
|
require "utils/curl"
|
|
output, errors, status = Utils::Curl.curl_output("--location", url.to_s, *args, secrets: [token])
|
|
output, _, http_code = output.rpartition("\n")
|
|
output, _, http_code = output.rpartition("\n") if http_code == "000"
|
|
headers = headers_tmpfile.read
|
|
ensure
|
|
if data_tmpfile
|
|
data_tmpfile.close
|
|
data_tmpfile.unlink
|
|
end
|
|
headers_tmpfile.close
|
|
headers_tmpfile.unlink
|
|
end
|
|
|
|
begin
|
|
raise_error(output, errors, http_code, headers, scopes) if !http_code.start_with?("2") || !status.success?
|
|
|
|
return if http_code == "204" # No Content
|
|
|
|
output = JSON.parse output if parse_json
|
|
if block_given?
|
|
yield output
|
|
else
|
|
output
|
|
end
|
|
rescue JSON::ParserError => e
|
|
raise Error, "Failed to parse JSON response\n#{e.message}", e.backtrace
|
|
end
|
|
end
|
|
|
|
def self.paginate_rest(url, additional_query_params: nil, per_page: 100, scopes: [].freeze)
|
|
(1..API_MAX_PAGES).each do |page|
|
|
retry_count = 1
|
|
result = begin
|
|
API.open_rest("#{url}?per_page=#{per_page}&page=#{page}&#{additional_query_params}", scopes:)
|
|
rescue Error
|
|
if retry_count < PAGINATE_RETRY_COUNT
|
|
retry_count += 1
|
|
retry
|
|
end
|
|
|
|
raise
|
|
end
|
|
break if result.blank?
|
|
|
|
yield(result, page)
|
|
end
|
|
end
|
|
|
|
def self.open_graphql(query, variables: nil, scopes: [].freeze, raise_errors: true)
|
|
data = { query:, variables: }
|
|
result = open_rest("#{API_URL}/graphql", scopes:, data:, request_method: "POST")
|
|
|
|
if raise_errors
|
|
if result["errors"].present?
|
|
raise Error, result["errors"].map { |e| "#{e["type"]}: #{e["message"]}" }.join("\n")
|
|
end
|
|
|
|
result["data"]
|
|
else
|
|
result
|
|
end
|
|
end
|
|
|
|
sig {
|
|
params(
|
|
query: String,
|
|
variables: T.nilable(T::Hash[Symbol, T.untyped]),
|
|
_block: T.proc.params(data: T::Hash[String, T.untyped]).returns(T::Hash[String, T.untyped]),
|
|
).void
|
|
}
|
|
def self.paginate_graphql(query, variables: nil, &_block)
|
|
result = API.open_graphql(query, variables:)
|
|
|
|
has_next_page = T.let(true, T::Boolean)
|
|
variables ||= {}
|
|
while has_next_page
|
|
page_info = yield result
|
|
has_next_page = page_info["hasNextPage"]
|
|
if has_next_page
|
|
variables[:after] = page_info["endCursor"]
|
|
result = API.open_graphql(query, variables:)
|
|
end
|
|
end
|
|
end
|
|
|
|
def self.raise_error(output, errors, http_code, headers, scopes)
|
|
json = begin
|
|
JSON.parse(output)
|
|
rescue
|
|
nil
|
|
end
|
|
message = json&.[]("message") || "curl failed! #{errors}"
|
|
|
|
meta = {}
|
|
headers.lines.each do |l|
|
|
key, _, value = l.delete(":").partition(" ")
|
|
key = key.downcase.strip
|
|
next if key.empty?
|
|
|
|
meta[key] = value.strip
|
|
end
|
|
|
|
credentials_error_message(meta, scopes)
|
|
|
|
case http_code
|
|
when "401"
|
|
raise AuthenticationFailedError.new(credentials_type, message)
|
|
when "403"
|
|
if meta.fetch("x-ratelimit-remaining", 1).to_i <= 0
|
|
reset = meta.fetch("x-ratelimit-reset").to_i
|
|
raise RateLimitExceededError.new(reset, message)
|
|
end
|
|
|
|
raise AuthenticationFailedError.new(credentials_type, message)
|
|
when "404"
|
|
raise MissingAuthenticationError if credentials_type == :none && scopes.present?
|
|
|
|
raise HTTPNotFoundError, message
|
|
when "422"
|
|
errors = json&.[]("errors") || []
|
|
raise ValidationFailedError.new(message, errors)
|
|
else
|
|
raise Error, message
|
|
end
|
|
end
|
|
end
|
|
end
|