Support gh credentials for HTTPS push

Author: blhsing

pythongit/cli.py

@@ -789,6 +789,9 @@ def cmd_config(argv: list[str]) -> int:
     ap = argparse.ArgumentParser(prog="pygit config")
     ap.add_argument("--global", dest="is_global", action="store_true")
     ap.add_argument("--unset", action="store_true")
+    ap.add_argument("--unset-all", dest="unset_all", action="store_true")
+    ap.add_argument("--add", action="store_true")
+    ap.add_argument("--replace-all", action="store_true")
     ap.add_argument("name")
     ap.add_argument("value", nargs="?")
     args = ap.parse_args(argv)
@@ -797,13 +800,13 @@ def cmd_config(argv: list[str]) -> int:
     else:
         cfg_path = _repo().gitdir / "config"
     import configparser
-    cp = configparser.ConfigParser()
+    cp = configparser.ConfigParser(interpolation=None)
     if cfg_path.exists():
         cp.read(cfg_path, encoding="utf-8")
-    sect, _, key = args.name.partition(".")
+    sect, key = _config_section_key(args.name)
     if not key:
         return 1
-    if args.unset:
+    if args.unset or args.unset_all:
         if cp.has_option(sect, key):
             cp.remove_option(sect, key)
             with cfg_path.open("w", encoding="utf-8") as f:
@@ -822,6 +825,16 @@ def cmd_config(argv: list[str]) -> int:
     return 0
 
 
+def _config_section_key(name: str) -> tuple[str, str]:
+    prefix, sep, key = name.rpartition(".")
+    if not sep or not prefix or not key:
+        return "", ""
+    section, dot, subsection = prefix.partition(".")
+    if dot:
+        return f'{section} "{subsection}"', key
+    return section, key
+
+
 def cmd_remote(argv: list[str]) -> int:
     ap = argparse.ArgumentParser(prog="pygit remote")
     sub = ap.add_subparsers(dest="action")

pythongit/protocol.py

@@ -10,8 +10,10 @@
 from __future__ import annotations
 
 import http.client
+import base64
 import os
 from pathlib import Path
+import subprocess
 import tempfile
 import urllib.parse
 import urllib.request
@@ -63,8 +65,68 @@ def _iter_pkt_stream(source) -> Iterator[bytes]:
         yield payload
 
 
+def _request_headers(url: str, extra: dict[str, str] | None = None) -> dict[str, str]:
+    headers = {"User-Agent": "pythongit/0.1"}
+    if extra:
+        headers.update(extra)
+    auth = _auth_header_for_url(url)
+    if auth:
+        headers["Authorization"] = auth
+    return headers
+
+
+def _auth_header_for_url(url: str) -> str | None:
+    user, password = _credentials_for_url(url)
+    if not user or not password:
+        return None
+    raw = f"{user}:{password}".encode("utf-8")
+    return "Basic " + base64.b64encode(raw).decode("ascii")
+
+
+def _credentials_for_url(url: str) -> tuple[str, str]:
+    parsed = urllib.parse.urlsplit(url)
+    scheme = parsed.scheme
+    host = parsed.hostname or ""
+    user = urllib.parse.unquote(parsed.username or "")
+    password = urllib.parse.unquote(parsed.password or "")
+    if user and password:
+        return user, password
+
+    try:
+        from . import bridges
+        fields = {"protocol": scheme, "host": host}
+        creds = bridges.credential_fill(fields, use_external=False)
+    except Exception:
+        creds = {}
+    user = user or creds.get("username", "")
+    password = password or creds.get("password", "")
+    if user and password:
+        return user, password
+
+    if scheme == "https" and host in {"github.com", "www.github.com"}:
+        token = os.environ.get("GH_TOKEN") or os.environ.get("GITHUB_TOKEN") or _gh_auth_token(host)
+        if token:
+            return user or "x-access-token", token
+    return "", ""
+
+
+def _gh_auth_token(host: str) -> str:
+    try:
+        proc = subprocess.run(
+            ["gh", "auth", "token", "--hostname", host],
+            text=True,
+            capture_output=True,
+            timeout=5,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return ""
+    if proc.returncode != 0:
+        return ""
+    return proc.stdout.strip()
+
+
 def _get(url: str) -> bytes:
-    req = urllib.request.Request(url, headers={"User-Agent": "pythongit/0.1"})
+    req = urllib.request.Request(url, headers=_request_headers(url))
     with urllib.request.urlopen(req) as r:
         return r.read()
 
@@ -74,11 +136,7 @@ def _post(url: str, body: bytes, content_type: str, accept: str) -> bytes:
         url,
         data=body,
         method="POST",
-        headers={
-            "User-Agent": "pythongit/0.1",
-            "Content-Type": content_type,
-            "Accept": accept,
-        },
+        headers=_request_headers(url, {"Content-Type": content_type, "Accept": accept}),
     )
     with urllib.request.urlopen(req) as r:
         return r.read()
@@ -89,11 +147,7 @@ def _post_stream(url: str, body: bytes, content_type: str, accept: str):
         url,
         data=body,
         method="POST",
-        headers={
-            "User-Agent": "pythongit/0.1",
-            "Content-Type": content_type,
-            "Accept": accept,
-        },
+        headers=_request_headers(url, {"Content-Type": content_type, "Accept": accept}),
     )
     return urllib.request.urlopen(req)
 
@@ -118,9 +172,8 @@ def _post_with_pack_file(
     try:
         conn.putrequest("POST", target)
         conn.putheader("Host", host_header)
-        conn.putheader("User-Agent", "pythongit/0.1")
-        conn.putheader("Content-Type", content_type)
-        conn.putheader("Accept", accept)
+        for key, value in _request_headers(url, {"Content-Type": content_type, "Accept": accept}).items():
+            conn.putheader(key, value)
         conn.putheader("Content-Length", str(len(prefix) + pack_size))
         conn.endheaders()
         if prefix:

tests/unit_integration.py

@@ -5,6 +5,7 @@
 import io
 import os
 import sys
+import configparser
 from pathlib import Path
 
 import pytest
@@ -579,6 +580,15 @@ def test_check_ignore_honors_directory_only_pattern(tmprepo, capsys):
     assert "build" in capsys.readouterr().out
 
 
+def test_config_replace_all_writes_subsection_keys(tmprepo):
+    repo, _path = tmprepo
+    assert cli_run("config", "--replace-all", "credential.https://github.com.helper", "!gh auth git-credential") == 0
+
+    cp = configparser.ConfigParser(interpolation=None)
+    cp.read(repo.gitdir / "config", encoding="utf-8")
+    assert cp.get('credential "https://github.com"', "helper") == "!gh auth git-credential"
+
+
 def test_format_patch_then_apply_roundtrip(tmprepo, tmp_path_factory):
     from tests.conftest import commit_one
     repo, path = tmprepo

tests/unit_modules.py

@@ -8,6 +8,7 @@
 from pythongit import rerere as rerere_mod
 from pythongit import bridges as bridges_mod
 from pythongit import cli as cli_mod
+from pythongit import protocol as protocol_mod
 
 
 # --- diff -----------------------------------------------------------------
@@ -195,6 +196,15 @@ def test_ignore_trailing_space_requires_escape(tmp_path):
     assert not ig.is_ignored("with")
 
 
+def test_protocol_auth_header_uses_github_token_env(tmp_path, monkeypatch):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.delenv("GIT_USERNAME", raising=False)
+    monkeypatch.delenv("GIT_PASSWORD", raising=False)
+    monkeypatch.setenv("GITHUB_TOKEN", "secret-token")
+    header = protocol_mod._auth_header_for_url("https://github.com/owner/repo.git")
+    assert header == "Basic eC1hY2Nlc3MtdG9rZW46c2VjcmV0LXRva2Vu"
+
+
 # --- rerere ---------------------------------------------------------------