Change token type to SecretStr in Settings

.github/workflows/test_and_lint.yml

@@ -29,13 +29,31 @@
       - name: Install dependencies
         run: poetry install
       - name: Ruff format
-        run: poetry run ruff format --check .
+        id: rufffmt
+        run: poetry run ruff format --check --preview --output-format github .
+        continue-on-error: true
       - name: Ruff check
+        id: ruffcheck
         run: poetry run ruff check .
+        continue-on-error: true
       - name: Mypy
+        id: mypy
         run: poetry run mypy .
+        continue-on-error: true
       - name: Pytest
+        id: pytest
         run: poetry run pytest .
+        continue-on-error: true
+      - name: Fail job if any step failed
+        run: exit 1
+        if: |
+          ${{
+            failure() 
+            || steps.rufffmt.conclusion == 'failure'
+            || steps.ruffcheck.conclusion == 'failure'
+            || steps.mypy.conclusion == 'failure'
+            || steps.pytest.conclusion == 'failure'
+          }}
   diff-lockfile-main:
     runs-on: ubuntu-latest
     name: Dogfooding main

diff_poetry_lock/github_api.py

@@ -26,7 +26,9 @@ class GithubApi:
     def __init__(self, settings: Settings) -> None:
         self.s = settings
         self.session = requests.session()
-        self.github = Github(auth=Auth.Token(self.s.token), base_url=self.s.api_url.rstrip("/"), per_page=100)
+        self.github = Github(
+            auth=Auth.Token(self.s.token.get_secret_value()), base_url=self.s.api_url.rstrip("/"), per_page=100
+        )
         self._repo: Repository | None = None
         self.requester = self.github.requester
         self._ref_hash_cache: dict[str, str] = {}
@@ -101,7 +103,7 @@ def get_file(self, ref: str) -> Response:
         r = self.session.get(
             f"{self.s.api_url}/repos/{self.s.repository}/contents/{self.s.lockfile_path}",
             params={"ref": ref},
-            headers=self.Headers.RAW.headers(self.s.token),
+            headers=self.Headers.RAW.headers(self.s.token.get_secret_value()),
             timeout=10,
             stream=True,
         )

diff_poetry_lock/settings.py

@@ -5,7 +5,7 @@
 from typing import Any, ClassVar
 
 from loguru import logger
-from pydantic import BaseSettings, Field, ValidationError, validator
+from pydantic import BaseSettings, Field, SecretStr, ValidationError, validator
 
 
 class Settings(ABC):
@@ -17,7 +17,7 @@ class Settings(ABC):
     base_ref: str
 
     # from step config including secrets
-    token: str
+    token: SecretStr
     lockfile_path: str
     api_url: str
 
@@ -50,7 +50,7 @@ class VelaSettings(BaseSettings, Settings):
     repo_branch: str = Field(env="VELA_REPO_BRANCH")
 
     # from step config including secrets
-    token: str = Field(env="PARAMETER_GITHUB_TOKEN")
+    token: SecretStr = Field(env="PARAMETER_GITHUB_TOKEN")
     lockfile_path: str = Field(env="PARAMETER_LOCKFILE_PATH", default="poetry.lock")
     api_url: str = Field(env="PARAMETER_GITHUB_API_URL", default="https://api.github.com")
 
@@ -74,7 +74,7 @@ class GitHubActionsSettings(BaseSettings, Settings):
     head_ref: str = Field(env="github_head_ref")
 
     # from step config including secrets
-    token: str = Field(env="input_github_token")
+    token: SecretStr = Field(env="input_github_token")
     lockfile_path: str = Field(env="input_lockfile_path", default="poetry.lock")
     api_url: str = Field(env="github_api_url", default="https://api.github.com")