mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-09 22:31:41 +00:00
116f88b023
The selector picked up two suites that can never pass in this stack, so editing either one turned the check permanently red: the presidio masking suite calls pytest.fail without an analyzer and anonymizer that up.sh never starts, and the pipecat audio suite skips itself at import time unless the NLTK punkt_tab data is present, which nothing installs. tests/e2e/coverage_registry/test_collector.py had the same problem for a different reason. Its nested pytest.main autoloads pytest-retry from the ci group the workflow installs and dies with "INTERNALERROR: no option named 'filtered_exceptions'", so the collect-only pass now disables that plugin. The plugin's entry point is pytest-retry, not retry, so the same one-word fix lands on mutmut's pytest_add_cli_args, where "-p no:retry" was disabling nothing. Two smaller holes in the harness: a canary argument the shell never expanded used to select nothing and let the gate pass green, and a secret that cannot be represented in both bash and dotenv was rejected without naming the key.
49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
import os
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
from typing import Final
|
|
|
|
from pydantic import TypeAdapter, ValidationError
|
|
|
|
secrets_adapter: Final[TypeAdapter[dict[str, str]]] = TypeAdapter(dict[str, str])
|
|
ENV_NAME: Final = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
|
|
MIN_MASKED_LENGTH: Final = 8
|
|
|
|
|
|
def main() -> int:
|
|
env_path: Final = Path(sys.argv[1])
|
|
try:
|
|
secrets: Final = {
|
|
key: value.rstrip("\r\n") for key, value in secrets_adapter.validate_json(sys.stdin.read()).items()
|
|
}
|
|
except (ValidationError, UnicodeError):
|
|
_ = sys.stderr.write("expected a JSON object containing string environment values\n")
|
|
return 1
|
|
unusable: Final = tuple(
|
|
key
|
|
for key, value in secrets.items()
|
|
if ENV_NAME.fullmatch(key) is None or any(char in value for char in "'\n\r\0")
|
|
)
|
|
if unusable:
|
|
_ = sys.stderr.write(
|
|
f"these names or values cannot be represented in both bash and dotenv: {' '.join(sorted(unusable))}\n"
|
|
)
|
|
return 1
|
|
for value in secrets.values():
|
|
if len(value) >= MIN_MASKED_LENGTH:
|
|
_ = sys.stdout.write(f"::add-mask::{value.replace('%', '%25')}\n")
|
|
sys.stdout.flush()
|
|
lines: Final = tuple(f"{key}='{value}'" for key, value in secrets.items() if value)
|
|
try:
|
|
with os.fdopen(os.open(env_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW, 0o600), "w") as handle:
|
|
os.fchmod(handle.fileno(), 0o600)
|
|
_ = handle.write("\n".join(lines) + "\n")
|
|
except OSError:
|
|
_ = sys.stderr.write("could not write the environment file\n")
|
|
return 1
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|