flowey_lib_common/
use_gh_cli.rs

1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4//! Set up `gh` CLI for use with flowey.
5//!
6//! The executable this node returns will wrap the base `gh` cli executable with
7//! some additional logic, notably, ensuring it is includes any necessary
8//! authentication.
9
10use flowey::node::prelude::*;
11use std::io::Write;
12
13#[derive(Serialize, Deserialize)]
14pub enum GhCliAuth<C = VarNotClaimed> {
15    /// Prompt user to log-in interactively.
16    LocalOnlyInteractive,
17    /// Set the value of the `GITHUB_TOKEN` environment variable to the
18    /// specified runtime String when invoking the `gh` CLI.
19    AuthToken(ReadVar<String, C>),
20}
21
22impl ClaimVar for GhCliAuth {
23    type Claimed = GhCliAuth<VarClaimed>;
24
25    fn claim(self, ctx: &mut StepCtx<'_>) -> Self::Claimed {
26        match self {
27            GhCliAuth::LocalOnlyInteractive => GhCliAuth::LocalOnlyInteractive,
28            GhCliAuth::AuthToken(v) => GhCliAuth::AuthToken(v.claim(ctx)),
29        }
30    }
31}
32
33flowey_request! {
34    pub enum Request {
35        /// Specify what authentication to use
36        WithAuth(GhCliAuth),
37        /// Get a path to `gh` executable
38        Get(WriteVar<PathBuf>),
39    }
40}
41
42new_flow_node!(struct Node);
43
44impl FlowNode for Node {
45    type Request = Request;
46
47    fn imports(ctx: &mut ImportCtx<'_>) {
48        ctx.import::<crate::download_gh_cli::Node>();
49    }
50
51    fn emit(requests: Vec<Self::Request>, ctx: &mut NodeCtx<'_>) -> anyhow::Result<()> {
52        let mut get_reqs = Vec::new();
53        let mut with_auth_interactive = false;
54        let mut with_auth_token = None;
55
56        for req in requests {
57            match req {
58                Request::WithAuth(v) => match v {
59                    GhCliAuth::LocalOnlyInteractive => with_auth_interactive = true,
60                    GhCliAuth::AuthToken(v) => {
61                        same_across_all_reqs_backing_var("WithAuth", &mut with_auth_token, v)?
62                    }
63                },
64                Request::Get(v) => get_reqs.push(v),
65            }
66        }
67
68        let get_reqs = get_reqs;
69        let auth = match (with_auth_interactive, with_auth_token) {
70            (true, None) => GhCliAuth::LocalOnlyInteractive,
71            (false, Some(v)) => GhCliAuth::AuthToken(v),
72            (true, Some(_)) => {
73                anyhow::bail!("`WithAuth` must be consistent across requests")
74            }
75            (false, None) => anyhow::bail!("Missing essential request: WithAuth"),
76        };
77
78        // -- end of req processing -- //
79
80        if get_reqs.is_empty() {
81            if let GhCliAuth::AuthToken(tok) = auth {
82                tok.claim_unused(ctx);
83            }
84            return Ok(());
85        }
86
87        if !matches!(ctx.backend(), FlowBackend::Local) {
88            if matches!(auth, GhCliAuth::LocalOnlyInteractive) {
89                anyhow::bail!("cannot use interactive auth on a non-local backend")
90            }
91        }
92
93        let gh_bin_path = ctx.reqv(crate::download_gh_cli::Request::Get);
94
95        ctx.emit_rust_step("setup gh cli", |ctx| {
96            let auth = auth.claim(ctx);
97            let get_reqs = get_reqs.claim(ctx);
98            let gh_bin_path = gh_bin_path.claim(ctx);
99            |rt| {
100                let gh_bin_path = rt.read(gh_bin_path).display().to_string();
101                let gh_token = match auth {
102                    GhCliAuth::LocalOnlyInteractive => String::new(),
103                    GhCliAuth::AuthToken(tok) => rt.read(tok),
104                };
105                // only set GITHUB_TOKEN if there is a value to set it to, otherwise
106                // let the user's environment take precedence over authenticating interactively
107                let gh_token = if !gh_token.is_empty() {
108                    match rt.platform().kind() {
109                        FlowPlatformKind::Windows => format!(r#"SET "GITHUB_TOKEN={gh_token}""#),
110                        FlowPlatformKind::Unix => format!(r#"GITHUB_TOKEN="{gh_token}""#),
111                    }
112                } else {
113                    String::new()
114                };
115
116                let shim_txt = match rt.platform().kind() {
117                    FlowPlatformKind::Windows => WINDOWS_SHIM_BAT.trim(),
118                    FlowPlatformKind::Unix => UNIX_SHIM_SH.trim(),
119                }
120                .replace("{GITHUB_TOKEN}", &gh_token)
121                .replace("{GH_BIN_PATH}", &gh_bin_path);
122
123                let script_name = match rt.platform().kind() {
124                    FlowPlatformKind::Windows => "shim.bat",
125                    FlowPlatformKind::Unix => "shim.sh",
126                };
127                let path = {
128                    let dst = std::env::current_dir()?.join(script_name);
129                    let mut options = fs_err::OpenOptions::new();
130                    #[cfg(unix)]
131                    fs_err::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o777); // executable
132                    let mut file = options.create_new(true).write(true).open(&dst)?;
133                    file.write_all(shim_txt.as_bytes())?;
134                    dst.absolute()?
135                };
136                if !flowey::shell_cmd!(rt, "{path} auth status")
137                    .ignore_status()
138                    .output()?
139                    .status
140                    .success()
141                {
142                    if matches!(rt.backend(), FlowBackend::Local) {
143                        flowey::shell_cmd!(rt, "{path} auth login").run()?;
144                    } else {
145                        anyhow::bail!("unable to authenticate with github - is GhCliAuth valid?")
146                    }
147                };
148
149                for var in get_reqs {
150                    rt.write(var, &path);
151                }
152
153                Ok(())
154            }
155        });
156
157        Ok(())
158    }
159}
160
161const UNIX_SHIM_SH: &str = r#"
162#!/bin/sh
163{GITHUB_TOKEN} exec {GH_BIN_PATH} "$@"
164"#;
165
166const WINDOWS_SHIM_BAT: &str = r#"
167@ECHO OFF
168{GITHUB_TOKEN}
169{GH_BIN_PATH} %*
170"#;
flowey_lib_common/use_gh_cli.rs

flowey_lib_common/
use_gh_cli.rs
