Repository navigation
fix(workspace): look up provider tokens as GITHUB_TOKEN - #5730
Draft
jpshackelford wants to merge 3 commits into
Draft
jpshackelford wants to merge 3 commits into
jpshackelford wants to merge 3 commits into
Conversation
clone_repos requested github_token, gitlab_token and bitbucket_token, so a token stored under its conventional env var name was never used and private repos were cloned without credentials. It now requests GITHUB_TOKEN etc. and falls back to the lowercase name served by older app servers. Fixes #5729 Co-authored-by: openhands <openhands@all-hands.dev>
1 of 6 tasks
Contributor
REST API breakage checks (OpenAPI) — ✅ PASSEDResult: ✅ PASSED |
Co-authored-by: openhands <openhands@all-hands.dev>
Contributor
Coverage Report •
|
||||||||||||||||||||||||||||||||||||||||
Closed
3 of 23 tasks
Co-authored-by: openhands <openhands@all-hands.dev>
Contributor
|
📁 PR Artifacts Notice This PR contains a |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HUMAN:
This PR is part of agentic self-healing work for the SDK.
AGENT:
Why
clone_reposrequested the provider token asgithub_token,gitlab_tokenorbitbucket_token. Everywhere else, including OpenHands conversations, the GitHub skill and the plugin-source docs, the same token isGITHUB_TOKEN. Secret names are case-sensitive. When a user stored their token under the documented name,clone_reposrangit clonewithout credentials, so their private repos failed to clone.Summary
PROVIDER_TOKEN_NAMESmaps providers toGITHUB_TOKEN,GITLAB_TOKENandBITBUCKET_TOKEN.clone_reposfalls back to the lowercase name when the uppercase one has no value, because app servers before fix: name provider tokens GITHUB_TOKEN in sandbox secrets endpoints enterprise#752 serve only the lowercase name.github_token, so its lookup is unchanged. Theverify-agent-serverfeature maps (F15, F18) now use the new names.Issue Number
Fixes #5729
How to Test
Run
uv run pytest tests/workspace/test_cloud_workspace_repos.py.test_clone_authenticates_with_token_stored_under_env_var_namestores the token asGITHUB_TOKEN,GITLAB_TOKENorBITBUCKET_TOKENand checks that it reaches the clone command.test_clone_falls_back_to_lowercase_token_namechecks the lookup order (uppercase, then lowercase) and that a token served only asgithub_tokenis still used.test_clone_prefers_uppercase_token_namechecks that the uppercase token wins when both names exist.I also ran the real
clone_reposwith a realgit cloneagainst a local bare repo that git could reach only through a token-bearinggithub.comURL (aninsteadOfrewrite, as in recipe F18.sdk-clone-repos). The token was stored only asGITHUB_TOKEN.main(acca181)['github_token']fatal: could not read Username for 'https://github.com', 0/1 cloned['GITHUB_TOKEN']Video/Screenshots
None.
Design Doc
None.
Type
Notes
RepoSource.get_token_name()now returns the uppercase name, which callers outsideclone_reposwill see. Once the enterprise change is deployed everywhere, the lowercase fallback can be removed.This PR was drafted by an AI agent (OpenHands) on behalf of @jpshackelford.
🐳 Agent Server images for this PR — GHCR package, pull/run commands, and all pushed tags (click to expand)
• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server
Variants & Base Images
eclipse-temurin:17-jdkpython-node-runtimepython-node-runtimepython-node-runtimegolang:1.21-bookwormPull (multi-arch manifest)
# Each variant is a multi-arch manifest supporting both amd64 and arm64 docker pull ghcr.io/openhands/agent-server:1190075-pythonRun
All tags pushed for this build
About Multi-Architecture Support
1190075-python) is a multi-arch manifest supporting both amd64 and arm641190075-python-amd64) are also available if needed