git tokens

reconcile/utils/git.py

@@ -6,17 +6,31 @@ class GitError(Exception):
     pass
 
 
-def clone(repo_url, wd, depth=None, verify=True):
+def clone(
+    repo_url: str,
+    wd: str,
+    depth: int | None = None,
+    verify: bool | None = True,
+    ref: str | None = None,
+    token: str | None = None,
+):
     cmd = ["git"]
     if not verify:
         cmd += ["-c", "http.sslVerify=false"]
     cmd += ["clone"]
     if depth:
         cmd += ["--depth", str(depth)]
-    cmd += [repo_url, wd]
+    if ref:
+        cmd += ["--branch", ref]
+    if token:
+        cmd.append(repo_url.replace("https://", f"https://{token}@"))
+    else:
+        cmd.append(repo_url)
+    cmd += [wd]
+    os.makedirs(wd, exist_ok=True)
     result = subprocess.run(cmd, cwd=wd, capture_output=True, check=False)
     if result.returncode != 0:
-        raise GitError(f"git clone failed: {repo_url}")
+        raise GitError(f"git clone failed: {repo_url}: {result}")
 
 
 def checkout(commit, wd):

reconcile/utils/gitlab_api.py

@@ -102,13 +102,13 @@ def __init__(
         self.server = instance["url"]
         if not secret_reader:
             secret_reader = SecretReader(settings=settings)
-        token = secret_reader.read(instance["token"])
+        self.token = secret_reader.read(instance["token"])
         self.ssl_verify = instance["sslVerify"]
         if self.ssl_verify is None:
             self.ssl_verify = True
         self.gl = gitlab.Gitlab(
             self.server,
-            private_token=token,
+            private_token=self.token,
             ssl_verify=self.ssl_verify,
             timeout=timeout,
         )

reconcile/utils/terrascript_aws_client.py

@@ -151,7 +151,7 @@
 from reconcile.gql_definitions.terraform_resources.terraform_resources_namespaces import (
     NamespaceTerraformResourceLifecycleV1,
 )
-from reconcile.utils import gql
+from reconcile.utils import git, gql
 from reconcile.utils.aws_api import (
     AmiTag,
     AWSApi,
@@ -634,8 +634,8 @@ def init_github(self) -> Github:
         if not self.github:
             with self.github_lock:
                 if not self.github:
-                    token = get_default_config()["token"]
-                    self.github = Github(token, base_url=GH_BASE_URL)
+                    self.token = get_default_config()["token"]
+                    self.github = Github(self.token, base_url=GH_BASE_URL)
         return self.github
 
     def init_gitlab(self) -> GitLabApi: