scripts: Pass GitHub token via commandline args

.github/workflows/bleeding.yml

@@ -59,7 +59,7 @@ jobs:
             python -m pip install -U pip
             python -m pip install -U -r misc/requirements/requirements-tox.txt
       - name: Run tox
-        run: tox -e build-release -- --asciidoc ../asciidoc/asciidoc.py
+        run: tox -e build-release -- --asciidoc ../asciidoc/asciidoc.py --gh-token "${{ secrets.GITHUB_TOKEN }}"
 
   irc:
     timeout-minutes: 2

scripts/dev/build_release.py

@@ -219,7 +219,7 @@ INFO_PLIST_UPDATES = {
 }
 
 
-def build_mac():
+def build_mac(*, gh_token):
     """Build macOS .dmg/.app."""
     utils.print_title("Cleaning up...")
     for f in ['wc.dmg', 'template.dmg']:
@@ -230,7 +230,7 @@ def build_mac():
     for d in ['dist', 'build']:
         shutil.rmtree(d, ignore_errors=True)
     utils.print_title("Updating 3rdparty content")
-    update_3rdparty.run(ace=False, pdfjs=True, fancy_dmg=False)
+    update_3rdparty.run(ace=False, pdfjs=True, fancy_dmg=False, gh_token=gh_token)
     utils.print_title("Building .app via pyinstaller")
     call_tox('pyinstaller-64', '-r')
     utils.print_title("Patching .app")
@@ -318,10 +318,11 @@ def _build_windows_single(*, x64, skip_packaging):
     )
 
 
-def build_windows(*, skip_packaging, skip_32bit, skip_64bit):
+def build_windows(*, gh_token, skip_packaging, skip_32bit, skip_64bit):
     """Build windows executables/setups."""
     utils.print_title("Updating 3rdparty content")
-    update_3rdparty.run(nsis=True, ace=False, pdfjs=True, fancy_dmg=False)
+    update_3rdparty.run(nsis=True, ace=False, pdfjs=True, fancy_dmg=False,
+                        gh_token=gh_token)
 
     utils.print_title("Building Windows binaries")
 
@@ -424,15 +425,26 @@ def test_makefile():
                         'DESTDIR={}'.format(tmpdir), 'install'], check=True)
 
 
-def read_github_token():
+def read_github_token(arg_token, *, optional=False):
     """Read the GitHub API token from disk."""
+    if arg_token is not None:
+        return arg_token
+
     token_file = os.path.join(os.path.expanduser('~'), '.gh_token')
+    if not os.path.exists(token_file):
+        if optional:
+            return None
+        else:
+            raise Exception(
+                "GitHub token needed, but ~/.gh_token not found, "
+                "and --gh-token not given.")
+
     with open(token_file, encoding='ascii') as f:
         token = f.read().strip()
     return token
 
 
-def github_upload(artifacts, tag):
+def github_upload(artifacts, tag, gh_token):
     """Upload the given artifacts to GitHub.
 
     Args:
@@ -443,8 +455,7 @@ def github_upload(artifacts, tag):
     import github3.exceptions
     utils.print_title("Uploading to github...")
 
-    token = read_github_token()
-    gh = github3.login(token=token)
+    gh = github3.login(token=gh_token)
     repo = gh.repository('qutebrowser', 'qutebrowser')
 
     release = None  # to satisfy pylint
@@ -509,6 +520,8 @@ def main():
     parser.add_argument('--asciidoc-python', help="Python to use for asciidoc."
                         "If not given, the current Python interpreter is used.",
                         nargs='?')
+    parser.add_argument('--gh-token', help="GitHub token to use.",
+                        nargs='?')
     parser.add_argument('--upload', action='store_true', required=False,
                         help="Toggle to upload the release to GitHub.")
     parser.add_argument('--skip-packaging', action='store_true', required=False,
@@ -526,7 +539,9 @@ def main():
         # Fail early when trying to upload without github3 installed
         # or without API token
         import github3  # pylint: disable=unused-import
-        read_github_token()
+        gh_token = read_github_token(args.gh_token)
+    else:
+        gh_token = read_github_token(args.gh_token, optional=True)
 
     if not misc_checks.check_git():
         utils.print_error("Refusing to do a release with a dirty git tree")
@@ -539,12 +554,13 @@ def main():
 
     if os.name == 'nt':
         artifacts = build_windows(
+            gh_token=gh_token,
             skip_packaging=args.skip_packaging,
             skip_32bit=args.skip_32bit,
             skip_64bit=args.skip_64bit,
         )
     elif sys.platform == 'darwin':
-        artifacts = build_mac()
+        artifacts = build_mac(gh_token=gh_token)
     else:
         upgrade_sdist_dependencies()
         test_makefile()
@@ -556,7 +572,7 @@ def main():
         utils.print_title("Press enter to release {}...".format(version_tag))
         input()
 
-        github_upload(artifacts, version_tag)
+        github_upload(artifacts, version_tag, gh_token=gh_token)
         if upload_to_pypi:
             pypi_upload(artifacts)
     else:

scripts/dev/update_3rdparty.py

@@ -64,7 +64,7 @@ def download_nsis_plugins():
     urllib.request.urlcleanup()
 
 
-def get_latest_pdfjs_url():
+def get_latest_pdfjs_url(gh_token):
     """Get the URL of the latest pdf.js prebuilt package.
 
     Returns a (version, url)-tuple.
@@ -73,12 +73,12 @@ def get_latest_pdfjs_url():
     endpoint = 'repos/mozilla/pdf.js/releases/latest'
     request = urllib.request.Request(f'{github_api}/{endpoint}')
 
-    token = os.environ.get('GITHUB_TOKEN')
-    if token is not None:
+    if gh_token is not None:
         # Without token will work as well, but has a strict rate limit, so we need to
         # use the token on CI.
-        request.add_header('Authorization', f'token {token}')
-        print("Using GITHUB_TOKEN to authorize to GitHub.")
+        request.add_header('Authorization', f'token {gh_token}')
+    elif 'CI' in os.environ:
+        raise Exception("No GitHub token given on CI")
 
     with urllib.request.urlopen(request) as fp:
         data = json.loads(fp.read().decode('utf-8'))
@@ -88,16 +88,17 @@ def get_latest_pdfjs_url():
     return (version_name, download_url)
 
 
-def update_pdfjs(target_version=None):
+def update_pdfjs(target_version=None, gh_token=None):
     """Download and extract the latest pdf.js version.
 
     If target_version is not None, download the given version instead.
 
     Args:
         target_version: None or version string ('x.y.z')
+        gh_token: GitHub token to use for the API. Optional except on CI.
     """
     if target_version is None:
-        version, url = get_latest_pdfjs_url()
+        version, url = get_latest_pdfjs_url(gh_token)
     else:
         # We need target_version as x.y.z, without the 'v' prefix, though the
         # user might give it on the command line
@@ -167,12 +168,12 @@ def test_dicts():
 
 
 def run(nsis=False, ace=False, pdfjs=True, fancy_dmg=False, pdfjs_version=None,
-        dicts=False):
+        dicts=False, gh_token=None):
     """Update components based on the given arguments."""
     if nsis:
         download_nsis_plugins()
     if pdfjs:
-        update_pdfjs(pdfjs_version)
+        update_pdfjs(pdfjs_version, gh_token=gh_token)
     if ace:
         update_ace()
     if fancy_dmg:
@@ -197,9 +198,11 @@ def main():
         help='Test whether all available dictionaries '
         'can be reached at the remote repository.',
         required=False, action='store_true')
+    parser.add_argument(
+        '--gh-token', help="GitHub token to use.", nargs='?')
     args = parser.parse_args()
     run(nsis=False, ace=True, pdfjs=True, fancy_dmg=args.fancy_dmg,
-        pdfjs_version=args.pdfjs, dicts=args.dicts)
+        pdfjs_version=args.pdfjs, dicts=args.dicts, gh_token=args.gh_token)
 
 
 if __name__ == '__main__':

tests/unit/utils/test_version.py

@@ -1006,7 +1006,7 @@ class TestWebEngineVersions:
         try:
             from PyQt5.QtWebEngine import PYQT_WEBENGINE_VERSION_STR
         except ImportError as e:
-            # QtWebKit or QtWebEngine < 5.13
+            # QtWebKit or QtWebEngine < 5.1'../3
             pytest.skip(str(e))
 
         pyqt_webengine_version = version._get_pyqt_webengine_qt_version()