Module: Dependabot::GithubActions::Lockfile::Env

Extended by:
T::Sig
Defined in:
lib/dependabot/github_actions/lockfile/env.rb

Overview

Builds the subprocess environment for the gh-actions-lock engine. Hosted Dependabot is tokenless behind a MITM proxy that overwrites the auth header, while proxyless local runs hold the real github.com token in credentials.

Constant Summary collapse

DUMMY_TOKEN =

Placeholder satisfies go-gh's "token must be present" check in hosted mode where the proxy supplies real auth. Mirrors git's installation-token username.

T.let("x-access-token", String)

Class Method Summary collapse

Class Method Details

.build(credentials) ⇒ Object 



26
27
28
29
30
31
32
33
34
 
# File 'lib/dependabot/github_actions/lockfile/env.rb', line 26

def self.build(credentials)
  env = {}

  github_credential = github_dot_com_credential(credentials)
  env["GH_TOKEN"] = github_credential&.fetch("password", nil) || DUMMY_TOKEN
  env["GH_ACTIONS_LOCK_DEPENDABOT_PROXY"] = "1" unless github_credential

  env
end

.github_dot_com_credential(credentials) ⇒ Object 



42
43
44
45
46
47
48
 
# File 'lib/dependabot/github_actions/lockfile/env.rb', line 42

def self.github_dot_com_credential(credentials)
  candidates = credentials.select do |c|
    c["type"] == "git_source" && c["host"] == GITHUB_COM && c["password"]
  end

  candidates.find { |c| !c["password"]&.start_with?("v1.") } || candidates.first
end