feat(sessionservice): load repo secrets before cloning#254
Draft
tildesrc wants to merge 3 commits into
Draft
Conversation
The host-side git operations (git clone / git fetch in CloneCache.ensure) run before the container starts, so credentials in env_file were never available to them. Private repos would fail at spawn-prep because GH_TOKEN wasn't in the subprocess environment. Fix: parse env_file into a dict in prepare_workspace (using an injectable _parse_env_file helper) and forward it to cache.ensure(), which passes it only to the network git operations (clone + fetch). merge --ff-only is local and gets no env. The CommandRunner protocol and both subprocess implementations (core.git and local_runner) gain an optional env kwarg that merges into os.environ for that call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ution The session service now loads repo secrets before git network operations (clone/fetch) so private repos can be accessed on the host before the container starts. This merge integrates that with main's changes: - env_file is now a relative name resolved via secrets_file_path() - test files moved to tests/sessionservice/; updated for new locations - local_runner cli test creates the secrets file for _parse_env_file Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…eature Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CloneCache.ensure()and the gitCommandRunnerprotocol to accept an optionalenvmapping, forwarded togit clone/git fetchsubprocess calls so credentials (e.g.GH_TOKEN) are available for host-side private-repo accessprepare_workspace()logic to resolve the repo'senv_filename viasecrets_file_path()and parse it before any git network operation — before the container startsparse_envinjectable throughout the call chain (prepare_workspace,Spawner,__main__.main) for testabilitytests/sessionservice/test_spawn.py; updates fakes in spawner/host/git/local-runner tests to accept the newenvkwarg🤖 Generated with Claude Code