Skip to content

Make GitHub remote parsing and authentication stricter#1626

Merged
mislav merged 5 commits intotrunkfrom
ghe-auth-tweaks
Sep 8, 2020
Merged

Make GitHub remote parsing and authentication stricter#1626
mislav merged 5 commits intotrunkfrom
ghe-auth-tweaks

Conversation

@mislav
Copy link
Contributor

@mislav mislav commented Sep 4, 2020

  • GITHUB_TOKEN is now only ever used for github.com API requests. This prevents the GitHub token leaking to 3rd-party hosts.
  • The new GITHUB_ENTERPRISE_TOKEN variable is now used for non-github.com API requests.
  • Git remote URL detection and parsing is now stricter: only URLs from supported protocols are considered.

TODO:

  • Update auth commands according to the new GITHUB_TOKEN/GITHUB_ENTERPRISE_TOKEN distinction.

We now only support git URLs that have one of the explicitly supported protocols.
Adding GITHUB_TOKEN & GITHUB_ENTERPRISE_TOKEN support orthogonal to
Config was getting out of hand, especially in `auth` commands that
adjust their messaging and error status based on the presence of these
environment variables.

The new approach builds in support for tokens from environment straight
into Config object by composition. Thus, commands need not ever be
concerned with any specific environment variables.
@mislav mislav marked this pull request as ready for review September 7, 2020 19:39
@mislav mislav merged commit 72e9747 into trunk Sep 8, 2020
@mislav mislav deleted the ghe-auth-tweaks branch September 8, 2020 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant