vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-forge: stop embedding the forge token in clone URLs

Browse source
This commit is contained in:
damocles 2026-08-26 00:20:58 +02:00
commit 676f7715fd
6 changed files with 154 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

20
hive-forge/src/main.rs
View file

@ -176,6 +176,13 @@ enum Verb {
/// Re-run CI without an empty commit. Pass one of `--pr <n>`,
/// `--run <n>`, or `--branch <name>`; `--workflow` defaults to `ci.yml`.
CiRerun(verbs::ci_rerun::Args),
/// Git credential-helper protocol (`get|store|erase`) — not a verb
/// you run by hand. `clone` configures each checkout's
/// `credential.helper` to invoke this, so git asks it for a token
/// fresh on every fetch/push instead of one being embedded in the
/// remote URL.
#[command(hide = true)]
CredentialHelper(verbs::credential_helper::Args),
}
/// Wrapper over [`run`] that owns how a failure reaches the operator.
@ -197,6 +204,14 @@ fn main() -> ExitCode {
fn run() -> Result<()> {
let cli = Cli::parse();
let verb = cli.verb;
// `credential-helper` bypasses the normal client construction below:
// it needs no repo (unlike `Client::from_env`, which errors without
// one), and git may invoke it from a directory that isn't a resolved
// checkout yet (mid-`clone`, before the destination exists).
if let Verb::CredentialHelper(args) = verb {
return verbs::credential_helper::run(args, cli.forge.as_deref());
}
let client = client::Client::from_env(cli.repo, cli.json, cli.forge)
.context("initialize forge client")?;
// Attach the resolved repo to every verb's error uniformly here,
@ -211,7 +226,7 @@ fn run() -> Result<()> {
// line 1 column 0" into "repo typo-org/repo: EOF while parsing a
// value at line 1 column 0", which is diagnosable on sight.
let repo = client.repo().to_owned();
dispatch(&client, cli.verb).with_context(|| format!("repo {repo}"))
dispatch(&client, verb).with_context(|| format!("repo {repo}"))
}
fn dispatch(client: &client::Client, verb: Verb) -> Result<()> {
@ -253,5 +268,8 @@ fn dispatch(client: &client::Client, verb: Verb) -> Result<()> {
Verb::ArtifactGet(a) => verbs::artifact_get::run(client, a),
Verb::CiLog(a) => verbs::ci_log::run(client, a),
Verb::CiRerun(a) => verbs::ci_rerun::run(client, a),
Verb::CredentialHelper(_) => {
unreachable!("handled in `run` before client construction")
}
}
}