Merge pull request #91 from legendu-net/push-uvsomptkxqvs

Merge push-uvsomptkxqvs Into main

Author: dclong

github_rest_api/github.py

@@ -1,16 +1,45 @@
 """Simple wrapper of GitHub REST APIs."""
 
+import re
 from abc import ABCMeta, abstractmethod
 from base64 import b64encode
 from collections.abc import Sequence
 from enum import StrEnum
-from typing import Any, Callable
 from pathlib import Path
+from typing import Any, Callable
+
 import requests
 from nacl import encoding, public
 
 URL_API = "https://api.github.com"
 
+_SECRET_NAME_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def _validate_secret_name(name: str) -> None:
+    """Validate a secret name against GitHub's naming rules.
+
+    GitHub rejects invalid secret names with a 422 response. Validating the
+    name client-side surfaces a clear error before the request is sent.
+
+    :param name: The name of the secret.
+    :raises ValueError: If the name is empty, starts with the reserved
+        ``GITHUB_`` prefix, starts with a digit, or contains characters other
+        than alphanumerics and underscores.
+    """
+    if not name:
+        raise ValueError("A secret name must not be empty.")
+    if name.upper().startswith("GITHUB_"):
+        raise ValueError(
+            f"Invalid secret name {name!r}: names must not start with the "
+            "reserved 'GITHUB_' prefix."
+        )
+    if not _SECRET_NAME_PATTERN.fullmatch(name):
+        raise ValueError(
+            f"Invalid secret name {name!r}: names may only contain alphanumeric "
+            "characters and underscores, and must not start with a digit."
+        )
+
 
 def _encrypt_secret(public_key: str, value: str) -> str:
     """Encrypt a secret value using a LibSodium sealed box.
@@ -354,6 +383,7 @@ def create_or_update_secret(
             automatically. Fetch it once and reuse it to avoid a redundant
             request when creating or updating multiple secrets.
         """
+        _validate_secret_name(name)
         if public_key is None:
             public_key = self.get_secret_public_key()
         return self._put(
@@ -549,6 +579,7 @@ def create_or_update_secret(
         :param selected_repository_ids: Repository IDs that can access the secret
             when visibility is `selected`.
         """
+        _validate_secret_name(name)
         if selected_repository_ids and visibility != SecretVisibility.SELECTED:
             raise ValueError(
                 "`selected_repository_ids` can only be provided when `visibility` is 'selected'."

github_rest_api/scripts/cargo/benchmark.py

@@ -1,18 +1,20 @@
 """Benchmark action using cargo criterion."""
 
-from typing import Callable
-import tempfile
-from pathlib import Path
 import datetime
 import shutil
 import subprocess as sp
+import tempfile
+from pathlib import Path
+from typing import Callable
+
 from dulwich import porcelain
+
 from ..utils import (
+    commit_benchmarks,
     config_git,
-    switch_branch,
-    push_branch,
     gen_temp_branch,
-    commit_benchmarks,
+    push_branch,
+    switch_branch,
 )
 
 

github_rest_api/scripts/cargo/profiling.py

@@ -1,14 +1,16 @@
 """Utils for profiling Rust applications."""
 
-from typing import Iterable
-from pathlib import Path
-import time
 import datetime
 import subprocess as sp
+import time
+from pathlib import Path
+from typing import Iterable
+
 import psutil
-from .utils import build_project
-from ..utils import config_git, switch_branch, push_branch, commit_profiling
+
 from ...utils import partition
+from ..utils import commit_profiling, config_git, push_branch, switch_branch
+from .utils import build_project
 
 
 def launch_application(cmd: list[str]) -> int:

github_rest_api/scripts/container/build_container_images.py

@@ -1,16 +1,17 @@
 import argparse
-from collections.abc import Sequence
 import datetime
-from pathlib import Path
 import subprocess as sp
 import sys
+from collections.abc import Sequence
+from pathlib import Path
 from typing import cast
+
 import yaml
-from dulwich.repo import Repo
-from dulwich.refs import Ref
-from dulwich.objects import Commit
-from dulwich.errors import NotGitRepository
 from dulwich.diff_tree import tree_changes
+from dulwich.errors import NotGitRepository
+from dulwich.objects import Commit
+from dulwich.refs import Ref
+from dulwich.repo import Repo
 from tenacity import retry, stop_after_attempt, wait_exponential
 
 

github_rest_api/scripts/container/config_container.py

@@ -1,11 +1,12 @@
 import argparse
 import json
 import shutil
+import subprocess as sp
 import sys
 import tomllib
-import tomli_w
 from pathlib import Path
-import subprocess as sp
+
+import tomli_w
 
 
 def config_docker(data_root: str = "/mnt/docker"):

github_rest_api/scripts/container/update_version_containerfile.py

@@ -1,13 +1,15 @@
 import argparse
 import datetime
 import os
+import re
 import sys
 from pathlib import Path
-import re
+
 from dulwich import porcelain
+from requests.exceptions import HTTPError
+
 from github_rest_api import Repository
 from github_rest_api.utils import next_minor_or_strip_patch
-from requests.exceptions import HTTPError
 
 
 def parse_latest_version(repo: str) -> str:

github_rest_api/scripts/github/add_github_repo.py

@@ -7,9 +7,10 @@
 import sys
 from collections.abc import Sequence
 from pathlib import Path
+
 from dulwich import porcelain
 
-from github_rest_api import User, Organization
+from github_rest_api import Organization, User
 
 
 def _validate_repo(repo: str) -> None:

github_rest_api/scripts/github/create_pull_request.py

@@ -2,9 +2,10 @@
 The branch is updated (using dev) before creating the PR.
 """
 
-from argparse import ArgumentParser, Namespace
 import os
 import sys
+from argparse import ArgumentParser, Namespace
+
 from github_rest_api import Repository
 from github_rest_api.utils import compile_patterns
 

github_rest_api/scripts/github/release_on_github.py

@@ -1,9 +1,10 @@
+import argparse
+import getpass
 import os
 import re
 import sys
-import argparse
-import getpass
 from pathlib import Path
+
 from github_rest_api import Repository
 from github_rest_api.scripts.utils import (
     find_project_root,

github_rest_api/scripts/github/remove_branch.py

@@ -1,7 +1,8 @@
 import argparse
+import datetime
 import re
 import sys
-import datetime
+
 from github_rest_api import Repository