dump-github 0.2.0__tar.gz

dump_github-0.2.0/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [0.2.0] - 2026-11-12
+
+### Added
+
+- Organisation support: `dump-github <org>` lists only repositories owned by
+  that organisation, through `GET /orgs/{org}/repos`.
+- `--version` flag.
+- Modern packaging: PEP 621 `pyproject.toml`, sdist **and** wheel builds,
+  `requires-python >= 3.10`, project URLs and PEP 639 license metadata.
+- CI workflow (tests on Python 3.9/3.12/3.13) and a tag-triggered PyPI release
+  workflow using Trusted Publishing.
+
+### Fixed
+
+- Token mode listed `GET /user/repos`, which returned the token owner's
+  personal repositories plus the repositories of every organisation the token
+  owner belongs to, and ignored the requested username. Listing is now scoped
+  to the requested account (user or organisation) and filters out repositories
+  owned by anybody else.
+- Zip archive URLs now use the repository's real `full_name` instead of the
+  positional username, so archives are always downloaded from the correct
+  owner.
+- Clone no longer embeds the token in the remote URL. A one-shot credential
+  helper supplies it through the child process environment, so the token is
+  not written to `.git/config` and does not show up in `ps` output.
+- Removed the accidental `argparse` runtime dependency (it is a standard
+  library module).
+
+### Tests
+
+- 15 unit and integration tests covering listing scopes, organisation
+  handling, pagination, foreign-owner filtering and the git credential helper.

dump_github-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Core2002
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

dump_github-0.2.0/MANIFEST.in

@@ -0,0 +1,4 @@
+include CHANGELOG.md
+include LICENSE
+include README.md
+recursive-include tests *.py

dump_github-0.2.0/PKG-INFO

@@ -0,0 +1,144 @@
+Metadata-Version: 2.4
+Name: dump-github
+Version: 0.2.0
+Summary: Back up users' GitHub repositories in case they need them later.
+Author-email: core2002 <core2002@aliyun.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Core2002/dump_github
+Project-URL: Repository, https://github.com/Core2002/dump_github
+Project-URL: Issues, https://github.com/Core2002/dump_github/issues
+Project-URL: Changelog, https://github.com/Core2002/dump_github/blob/main/CHANGELOG.md
+Keywords: github,backup,repositories,cli
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: System :: Archiving :: Backup
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+Dynamic: license-file
+
+### Github Dumper
+
+[![CI](https://github.com/Core2002/dump_github/actions/workflows/ci.yml/badge.svg)](https://github.com/Core2002/dump_github/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/dump-github.svg)](https://pypi.org/project/dump-github/)
+
+Github Dumper is a Python program designed to search for users' GitHub repositories and download the repositories. This tool can be used to back up users' GitHub repositories in case they need them later.
+
+**Install (Python 3.10+):**
+
+```
+pip install -U dump-github
+```
+
+**Usage:**
+
+```
+usage: dump-github [-h] [-d] [-p] [--version] [--token TOKEN]
+                   [--limit_size LIMIT_SIZE]
+                   username
+
+Backup users github repo.
+
+positional arguments:
+  username
+
+options:
+  -h, --help            show this help message and exit
+  -d, --download_zip    only download zip file
+  -p, --print           only print urls
+  --version             show program's version number and exit
+  --token TOKEN         GitHub personal access token (or set GITHUB_TOKEN).
+                        Required for private repos and higher API rate limits.
+  --limit_size LIMIT_SIZE
+                        limit size(MB) of download zip file, if 0 then no
+                        limit(default:100).
+
+https://github.com/Core2002/dump_github
+```
+
+### Authentication (token)
+
+GitHub’s API requires a proper `Authorization: Bearer <token>` header. This tool accepts a **personal access token** in two ways (first match wins):
+
+1. **`--token`** on the command line  
+2. **`GITHUB_TOKEN`** environment variable (if `--token` is empty)
+
+**Why use a token?**
+
+- **Private repositories**: Without a token, only public repos are listed and can be cloned or archived. With a token that has the right scopes, you can include private repos you are allowed to access (for example when backing up your own account).
+- **Rate limits**: Authenticated API requests get a much higher limit than anonymous requests.
+
+**How the token is used**
+
+- **Listing repos**: sent as `Bearer` on the REST API and scoped strictly to the requested account:
+  - **organisation** → `GET /orgs/{org}/repos?type=all` — only repositories owned by that organisation (private ones included when the token may access them);
+  - **your own user account** → `GET /user/repos?affiliation=owner` — private and public repos, without organisation/collaborator repos;
+  - **any other user** → `GET /users/{username}/repos?type=owner`.
+
+  Repositories whose owner is not the requested account are discarded as a final guard, so a user dump never includes organisation repositories and an organisation dump never includes user repositories.
+- **Clone** (default mode): the token is handed to `git` through a one-shot credential helper (`credential.helper` reads `DUMP_GITHUB_TOKEN` from the child process environment), so the clone URL stays `https://github.com/...`. The token is never shown in `ps` output and never written to the cloned repository's `.git/config`; existing credential helpers are reset for that clone so a stale stored credential cannot shadow the token.
+- **Zip download** (`-d`): uses the [repository archive (zipball)](https://docs.github.com/en/rest/repos/repos#download-a-repository-archive-zip) API with the same `Bearer` header (via `curl`), which works for private repos; without a token, public archive URLs are used instead.
+
+Create a token under GitHub → **Settings** → **Developer settings** → **Personal access tokens**. For private repo backup, enable access to **repository contents** (classic PAT: `repo` scope; fine-grained: read access to the repositories you need).
+
+**Examples**
+
+```bash
+# Public repos only (no token)
+dump-github Core2002 -p
+
+# Token on the command line (private + higher API limits)
+dump-github username --token ghp_xxxxxxxxxxxx
+
+# Back up an organisation (only that organisation's repositories)
+dump-github some-org --token ghp_xxxxxxxxxxxx
+
+# Same, via environment variable (recommended to avoid shell history)
+export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
+dump-github Core2002 -d
+```
+
+**Security note:** Do not commit tokens or paste them into shared logs. Prefer `GITHUB_TOKEN` in a local shell profile or a secret manager, and rotate the token if it leaks. Cloned repositories keep a clean remote URL (`https://github.com/...`), so `.git/config` does not contain the token.
+
+### Development
+
+```bash
+python -m venv .venv
+source .venv/bin/activate        # Windows: .venv\Scripts\activate
+python -m pip install -e ".[dev]"
+python -m unittest discover -s tests -v
+python -m build                  # dist/: sdist + wheel
+python -m twine check dist/*
+```
+
+CI runs the test suite on Python 3.10, 3.12 and 3.13, and checks the build metadata with `twine check` (`.github/workflows/ci.yml`).
+
+### Releasing
+
+1. Bump `__version__` in `dump_github/_version.py` and move the changelog entries in `CHANGELOG.md` to the new version.
+2. Commit, tag and push:
+   ```bash
+   git tag v0.2.0
+   git push origin main v0.2.0
+   ```
+3. The `Release` workflow runs the tests, builds the sdist and wheel, checks them with `twine check` and publishes both to PyPI through **Trusted Publishing**.
+
+One-time setup on PyPI: add a trusted publisher for the `Core2002/dump_github` repository and the `release.yml` workflow. No PyPI API token is stored in the repository. Manual fallback:
+
+```bash
+python -m build
+python -m twine upload dist/*
+```

dump_github-0.2.0/README.md

@@ -0,0 +1,112 @@
+### Github Dumper
+
+[![CI](https://github.com/Core2002/dump_github/actions/workflows/ci.yml/badge.svg)](https://github.com/Core2002/dump_github/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/dump-github.svg)](https://pypi.org/project/dump-github/)
+
+Github Dumper is a Python program designed to search for users' GitHub repositories and download the repositories. This tool can be used to back up users' GitHub repositories in case they need them later.
+
+**Install (Python 3.10+):**
+
+```
+pip install -U dump-github
+```
+
+**Usage:**
+
+```
+usage: dump-github [-h] [-d] [-p] [--version] [--token TOKEN]
+                   [--limit_size LIMIT_SIZE]
+                   username
+
+Backup users github repo.
+
+positional arguments:
+  username
+
+options:
+  -h, --help            show this help message and exit
+  -d, --download_zip    only download zip file
+  -p, --print           only print urls
+  --version             show program's version number and exit
+  --token TOKEN         GitHub personal access token (or set GITHUB_TOKEN).
+                        Required for private repos and higher API rate limits.
+  --limit_size LIMIT_SIZE
+                        limit size(MB) of download zip file, if 0 then no
+                        limit(default:100).
+
+https://github.com/Core2002/dump_github
+```
+
+### Authentication (token)
+
+GitHub’s API requires a proper `Authorization: Bearer <token>` header. This tool accepts a **personal access token** in two ways (first match wins):
+
+1. **`--token`** on the command line  
+2. **`GITHUB_TOKEN`** environment variable (if `--token` is empty)
+
+**Why use a token?**
+
+- **Private repositories**: Without a token, only public repos are listed and can be cloned or archived. With a token that has the right scopes, you can include private repos you are allowed to access (for example when backing up your own account).
+- **Rate limits**: Authenticated API requests get a much higher limit than anonymous requests.
+
+**How the token is used**
+
+- **Listing repos**: sent as `Bearer` on the REST API and scoped strictly to the requested account:
+  - **organisation** → `GET /orgs/{org}/repos?type=all` — only repositories owned by that organisation (private ones included when the token may access them);
+  - **your own user account** → `GET /user/repos?affiliation=owner` — private and public repos, without organisation/collaborator repos;
+  - **any other user** → `GET /users/{username}/repos?type=owner`.
+
+  Repositories whose owner is not the requested account are discarded as a final guard, so a user dump never includes organisation repositories and an organisation dump never includes user repositories.
+- **Clone** (default mode): the token is handed to `git` through a one-shot credential helper (`credential.helper` reads `DUMP_GITHUB_TOKEN` from the child process environment), so the clone URL stays `https://github.com/...`. The token is never shown in `ps` output and never written to the cloned repository's `.git/config`; existing credential helpers are reset for that clone so a stale stored credential cannot shadow the token.
+- **Zip download** (`-d`): uses the [repository archive (zipball)](https://docs.github.com/en/rest/repos/repos#download-a-repository-archive-zip) API with the same `Bearer` header (via `curl`), which works for private repos; without a token, public archive URLs are used instead.
+
+Create a token under GitHub → **Settings** → **Developer settings** → **Personal access tokens**. For private repo backup, enable access to **repository contents** (classic PAT: `repo` scope; fine-grained: read access to the repositories you need).
+
+**Examples**
+
+```bash
+# Public repos only (no token)
+dump-github Core2002 -p
+
+# Token on the command line (private + higher API limits)
+dump-github username --token ghp_xxxxxxxxxxxx
+
+# Back up an organisation (only that organisation's repositories)
+dump-github some-org --token ghp_xxxxxxxxxxxx
+
+# Same, via environment variable (recommended to avoid shell history)
+export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
+dump-github Core2002 -d
+```
+
+**Security note:** Do not commit tokens or paste them into shared logs. Prefer `GITHUB_TOKEN` in a local shell profile or a secret manager, and rotate the token if it leaks. Cloned repositories keep a clean remote URL (`https://github.com/...`), so `.git/config` does not contain the token.
+
+### Development
+
+```bash
+python -m venv .venv
+source .venv/bin/activate        # Windows: .venv\Scripts\activate
+python -m pip install -e ".[dev]"
+python -m unittest discover -s tests -v
+python -m build                  # dist/: sdist + wheel
+python -m twine check dist/*
+```
+
+CI runs the test suite on Python 3.10, 3.12 and 3.13, and checks the build metadata with `twine check` (`.github/workflows/ci.yml`).
+
+### Releasing
+
+1. Bump `__version__` in `dump_github/_version.py` and move the changelog entries in `CHANGELOG.md` to the new version.
+2. Commit, tag and push:
+   ```bash
+   git tag v0.2.0
+   git push origin main v0.2.0
+   ```
+3. The `Release` workflow runs the tests, builds the sdist and wheel, checks them with `twine check` and publishes both to PyPI through **Trusted Publishing**.
+
+One-time setup on PyPI: add a trusted publisher for the `Core2002/dump_github` repository and the `release.yml` workflow. No PyPI API token is stored in the repository. Manual fallback:
+
+```bash
+python -m build
+python -m twine upload dist/*
+```

dump_github-0.2.0/dump_github/__init__.py

@@ -0,0 +1,4 @@
+from ._version import __version__
+from .main import main
+
+__all__ = ["__version__", "main"]

dump_github-0.2.0/dump_github/_version.py

@@ -0,0 +1 @@
+__version__ = "0.2.0"

dump_github-0.2.0/dump_github/lib.py

@@ -0,0 +1,158 @@
+from urllib.parse import quote
+
+import requests
+
+GITHUB_API = "https://api.github.com"
+PER_PAGE = 100
+
+
+def _github_auth_headers(token):
+    """GitHub REST API expects Authorization: Bearer <token> (PAT classic / fine-grained)."""
+    if not token:
+        return {}
+    token = token.strip()
+    if not token:
+        return {}
+    if token.lower().startswith(("bearer ", "token ", "basic ")):
+        return {"Authorization": token}
+    return {"Authorization": "Bearer {}".format(token)}
+
+
+def _api_headers(token=""):
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+    headers.update(_github_auth_headers(token))
+    return headers
+
+
+def _api_get(path, token=""):
+    """GET one GitHub REST API path and return the decoded JSON, or None on failure."""
+    try:
+        response = requests.get(
+            GITHUB_API + path, headers=_api_headers(token), timeout=30
+        )
+    except requests.RequestException:
+        return None
+    if response.status_code != 200:
+        return None
+    try:
+        return response.json()
+    except ValueError:
+        return None
+
+
+def get_authenticated_login(token=""):
+    """Return the login of the token owner, or None if there is no usable token."""
+    if not _github_auth_headers(token):
+        return None
+    account = _api_get("/user", token)
+    if not isinstance(account, dict):
+        return None
+    return account.get("login") or None
+
+
+def get_account_type(username, token=""):
+    """Return ``"Organization"``/``"User"`` for ``username``, or None if unknown."""
+    quoted = quote(username, safe="")
+    account = _api_get("/users/{}".format(quoted), token)
+    if isinstance(account, dict) and account.get("type"):
+        return account["type"]
+    # ``/users/{org}`` is not guaranteed to resolve for organisations, so fall
+    # back to the org endpoint, which unambiguously identifies one.
+    org = _api_get("/orgs/{}".format(quoted), token)
+    if isinstance(org, dict) and org.get("login"):
+        return "Organization"
+    return None
+
+
+def _repos_path(username, page, authenticated_login, account_type):
+    """Build a listing API path that only contains repositories owned by ``username``.
+
+    ``GET /user/repos`` (used by an earlier version whenever a token was
+    supplied) lists every repository the token owner can see, which includes
+    repositories of the organisations the token owner is a member of, and it
+    ignores ``username`` entirely.  Listing must therefore be scoped to the
+    requested account:
+
+    * organisation -> ``/orgs/{org}/repos?type=all``; only repositories owned
+      by that organisation, including private ones the token may access
+    * own user account -> ``/user/repos?affiliation=owner``; keeps private
+      repos, drops organisation/collaborator repos
+    * any other user account -> ``/users/{username}/repos?type=owner``
+    """
+    quoted = quote(username, safe="")
+    if (account_type or "").lower() == "organization":
+        return "/orgs/{}/repos?type=all&per_page={}&page={}".format(
+            quoted, PER_PAGE, page
+        )
+    own_account = bool(authenticated_login) and (
+        authenticated_login.lower() == username.lower()
+    )
+    if own_account:
+        return "/user/repos?affiliation=owner&per_page={}&page={}".format(
+            PER_PAGE, page
+        )
+    return "/users/{}/repos?type=owner&per_page={}&page={}".format(
+        quoted, PER_PAGE, page
+    )
+
+
+def _is_owned_by(repo, username):
+    owner = repo.get("owner") or {}
+    login = owner.get("login") or ""
+    if login:
+        return login.lower() == username.lower()
+    full_name = repo.get("full_name") or ""
+    return full_name.split("/", 1)[0].lower() == username.lower()
+
+
+def _fetch_repos_page(username, page, token="", authenticated_login=None,
+                      account_type=None):
+    """Fetch one raw page of repositories owned by ``username``."""
+    path = _repos_path(username, page, authenticated_login, account_type)
+    repos = _api_get(path, token)
+    if not isinstance(repos, list):
+        return []
+    return [repo for repo in repos if isinstance(repo, dict)]
+
+
+def get_page_of_repos(username, page, token="", authenticated_login=None,
+                      account_type=None):
+    username = username.strip()
+    if account_type is None:
+        account_type = get_account_type(username, token)
+    if authenticated_login is None:
+        authenticated_login = get_authenticated_login(token)
+    repos = _fetch_repos_page(
+        username, page, token, authenticated_login, account_type
+    )
+    return [repo for repo in repos if _is_owned_by(repo, username)]
+
+
+def search_user_repos(username, token=""):
+    username = username.strip()
+    authenticated_login = get_authenticated_login(token)
+    account_type = get_account_type(username, token)
+    page = 0
+    res_repos = []
+
+    while True:
+        page += 1
+        repos = _fetch_repos_page(
+            username, page, token, authenticated_login, account_type
+        )
+        if len(repos) == 0:
+            break
+        res_repos += repos
+        if len(repos) < PER_PAGE:
+            break
+
+    # Never return repositories that belong to somebody else (e.g. a user repo
+    # returned for an organisation, or an organisation the token owner is in).
+    return [repo for repo in res_repos if _is_owned_by(repo, username)]
+
+
+# Backward-compatible alias for the historical typo
+serach_user_repos = search_user_repos

dump_github-0.2.0/dump_github/main.py

@@ -0,0 +1,131 @@
+import argparse
+import os
+import subprocess
+
+from ._version import __version__
+from .lib import search_user_repos
+
+# One-shot credential helper: git asks for credentials, the helper answers with
+# the token from the environment.  The token is therefore never part of the
+# clone URL and never gets written to the cloned repository's .git/config.
+GIT_CREDENTIAL_HELPER = (
+    '!f() { test "$1" = get || return 0; '
+    'echo username=x-access-token; '
+    'echo "password=$DUMP_GITHUB_TOKEN"; }; f'
+)
+
+parser = argparse.ArgumentParser(
+    prog="dump-github",
+    description="Backup users github repo.",
+    epilog="https://github.com/Core2002/dump_github",
+)
+
+parser.add_argument("username")
+parser.add_argument(
+    "-d", "--download_zip", action="store_true", help="only download zip file"
+)
+parser.add_argument("-p", "--print", action="store_true", help="only print urls")
+parser.add_argument(
+    "--version", action="version", version="%(prog)s {}".format(__version__)
+)
+parser.add_argument(
+    "--token",
+    action="store",
+    default="",
+    help="GitHub personal access token (or set GITHUB_TOKEN). Required for private repos and higher API rate limits.",
+)
+parser.add_argument(
+    "--limit_size",
+    type=int,
+    default=100,
+    help="limit size(MB) of download zip file, if 0 then no limit(default:100).",
+)
+
+
+def clone_repo(repo, token=""):
+    name = repo["name"]
+    url = repo["clone_url"]
+    cmd = ["git", "clone", url]
+    env = None
+    if token:
+        # Use a credential helper instead of https://x-access-token:TOKEN@...
+        # so the token does not leak into `ps` output or .git/config.
+        cmd = [
+            "git",
+            "-c",
+            "credential.helper=",
+            "-c",
+            "credential.helper={}".format(GIT_CREDENTIAL_HELPER),
+            "clone",
+            url,
+        ]
+        env = os.environ.copy()
+        env["DUMP_GITHUB_TOKEN"] = token
+        env["GIT_TERMINAL_PROMPT"] = "0"
+    print("Clone repo: {}".format(name))
+    subprocess.run(cmd, env=env, check=False)
+
+
+def download_zip(user_name, reop, token="", limit_size=100):
+    ref = reop.get("default_branch") or "main"
+    # Always archive the repository the API actually listed.  Using the
+    # positional username here would point at the wrong owner whenever the
+    # repo does not belong to that user.
+    full_name = reop.get("full_name") or "{}/{}".format(user_name, reop["name"])
+    max_size = limit_size * 1000 * 1000
+    file_name = "./{}.zip".format(full_name.replace("/", "_"))
+    curl_cmd = [
+        "curl",
+        "-sS",
+        "-L",
+        "--connect-timeout",
+        "5",
+        "--retry",
+        "3",
+        "--retry-delay",
+        "3",
+    ]
+    if max_size > 0:
+        curl_cmd.extend(["--max-filesize", str(max_size)])
+    if token:
+        url = "https://api.github.com/repos/{}/zipball/{}".format(full_name, ref)
+        curl_cmd.extend(
+            [
+                "-H",
+                "Authorization: Bearer {}".format(token),
+                "-H",
+                "Accept: application/vnd.github+json",
+                "-o",
+                file_name,
+                url,
+            ]
+        )
+    else:
+        url = "https://github.com/{}/archive/refs/heads/{}.zip".format(full_name, ref)
+        curl_cmd.extend(["-o", file_name, url])
+    print("Download {} : {}".format(reop["name"], url))
+    subprocess.run(curl_cmd, check=False)
+    if (
+        max_size > 0
+        and os.path.exists(file_name)
+        and os.stat(file_name).st_size > max_size
+    ):
+        os.remove(file_name)
+        print("Removed {} because it exceeds the limit size.".format(file_name))
+
+
+def main(argv=None):
+    args = parser.parse_args(argv)
+    token = (args.token or "").strip() or (os.environ.get("GITHUB_TOKEN") or "").strip()
+    repos = search_user_repos(args.username, token)
+    for repo in repos:
+        if args.print:
+            print(repo["clone_url"])
+        elif args.download_zip:
+            download_zip(args.username, repo, token, args.limit_size)
+        else:
+            clone_repo(repo, token)
+
+
+if __name__ == "__main__":
+    main()

dump_github-0.2.0/dump_github.egg-info/PKG-INFO

@@ -0,0 +1,144 @@
+Metadata-Version: 2.4
+Name: dump-github
+Version: 0.2.0
+Summary: Back up users' GitHub repositories in case they need them later.
+Author-email: core2002 <core2002@aliyun.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Core2002/dump_github
+Project-URL: Repository, https://github.com/Core2002/dump_github
+Project-URL: Issues, https://github.com/Core2002/dump_github/issues
+Project-URL: Changelog, https://github.com/Core2002/dump_github/blob/main/CHANGELOG.md
+Keywords: github,backup,repositories,cli
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: System :: Archiving :: Backup
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+Dynamic: license-file
+
+### Github Dumper
+
+[![CI](https://github.com/Core2002/dump_github/actions/workflows/ci.yml/badge.svg)](https://github.com/Core2002/dump_github/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/dump-github.svg)](https://pypi.org/project/dump-github/)
+
+Github Dumper is a Python program designed to search for users' GitHub repositories and download the repositories. This tool can be used to back up users' GitHub repositories in case they need them later.
+
+**Install (Python 3.10+):**
+
+```
+pip install -U dump-github
+```
+
+**Usage:**
+
+```
+usage: dump-github [-h] [-d] [-p] [--version] [--token TOKEN]
+                   [--limit_size LIMIT_SIZE]
+                   username
+
+Backup users github repo.
+
+positional arguments:
+  username
+
+options:
+  -h, --help            show this help message and exit
+  -d, --download_zip    only download zip file
+  -p, --print           only print urls
+  --version             show program's version number and exit
+  --token TOKEN         GitHub personal access token (or set GITHUB_TOKEN).
+                        Required for private repos and higher API rate limits.
+  --limit_size LIMIT_SIZE
+                        limit size(MB) of download zip file, if 0 then no
+                        limit(default:100).
+
+https://github.com/Core2002/dump_github
+```
+
+### Authentication (token)
+
+GitHub’s API requires a proper `Authorization: Bearer <token>` header. This tool accepts a **personal access token** in two ways (first match wins):
+
+1. **`--token`** on the command line  
+2. **`GITHUB_TOKEN`** environment variable (if `--token` is empty)
+
+**Why use a token?**
+
+- **Private repositories**: Without a token, only public repos are listed and can be cloned or archived. With a token that has the right scopes, you can include private repos you are allowed to access (for example when backing up your own account).
+- **Rate limits**: Authenticated API requests get a much higher limit than anonymous requests.
+
+**How the token is used**
+
+- **Listing repos**: sent as `Bearer` on the REST API and scoped strictly to the requested account:
+  - **organisation** → `GET /orgs/{org}/repos?type=all` — only repositories owned by that organisation (private ones included when the token may access them);
+  - **your own user account** → `GET /user/repos?affiliation=owner` — private and public repos, without organisation/collaborator repos;
+  - **any other user** → `GET /users/{username}/repos?type=owner`.
+
+  Repositories whose owner is not the requested account are discarded as a final guard, so a user dump never includes organisation repositories and an organisation dump never includes user repositories.
+- **Clone** (default mode): the token is handed to `git` through a one-shot credential helper (`credential.helper` reads `DUMP_GITHUB_TOKEN` from the child process environment), so the clone URL stays `https://github.com/...`. The token is never shown in `ps` output and never written to the cloned repository's `.git/config`; existing credential helpers are reset for that clone so a stale stored credential cannot shadow the token.
+- **Zip download** (`-d`): uses the [repository archive (zipball)](https://docs.github.com/en/rest/repos/repos#download-a-repository-archive-zip) API with the same `Bearer` header (via `curl`), which works for private repos; without a token, public archive URLs are used instead.
+
+Create a token under GitHub → **Settings** → **Developer settings** → **Personal access tokens**. For private repo backup, enable access to **repository contents** (classic PAT: `repo` scope; fine-grained: read access to the repositories you need).
+
+**Examples**
+
+```bash
+# Public repos only (no token)
+dump-github Core2002 -p
+
+# Token on the command line (private + higher API limits)
+dump-github username --token ghp_xxxxxxxxxxxx
+
+# Back up an organisation (only that organisation's repositories)
+dump-github some-org --token ghp_xxxxxxxxxxxx
+
+# Same, via environment variable (recommended to avoid shell history)
+export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
+dump-github Core2002 -d
+```
+
+**Security note:** Do not commit tokens or paste them into shared logs. Prefer `GITHUB_TOKEN` in a local shell profile or a secret manager, and rotate the token if it leaks. Cloned repositories keep a clean remote URL (`https://github.com/...`), so `.git/config` does not contain the token.
+
+### Development
+
+```bash
+python -m venv .venv
+source .venv/bin/activate        # Windows: .venv\Scripts\activate
+python -m pip install -e ".[dev]"
+python -m unittest discover -s tests -v
+python -m build                  # dist/: sdist + wheel
+python -m twine check dist/*
+```
+
+CI runs the test suite on Python 3.10, 3.12 and 3.13, and checks the build metadata with `twine check` (`.github/workflows/ci.yml`).
+
+### Releasing
+
+1. Bump `__version__` in `dump_github/_version.py` and move the changelog entries in `CHANGELOG.md` to the new version.
+2. Commit, tag and push:
+   ```bash
+   git tag v0.2.0
+   git push origin main v0.2.0
+   ```
+3. The `Release` workflow runs the tests, builds the sdist and wheel, checks them with `twine check` and publishes both to PyPI through **Trusted Publishing**.
+
+One-time setup on PyPI: add a trusted publisher for the `Core2002/dump_github` repository and the `release.yml` workflow. No PyPI API token is stored in the repository. Manual fallback:
+
+```bash
+python -m build
+python -m twine upload dist/*
+```

dump_github-0.2.0/dump_github.egg-info/SOURCES.txt

@@ -0,0 +1,18 @@
+CHANGELOG.md
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+dump_github/__init__.py
+dump_github/_version.py
+dump_github/lib.py
+dump_github/main.py
+dump_github.egg-info/PKG-INFO
+dump_github.egg-info/SOURCES.txt
+dump_github.egg-info/dependency_links.txt
+dump_github.egg-info/entry_points.txt
+dump_github.egg-info/requires.txt
+dump_github.egg-info/top_level.txt
+tests/__init__.py
+tests/test_lib.py
+tests/test_main.py

dump_github-0.2.0/dump_github.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

dump_github-0.2.0/dump_github.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+dump-github = dump_github:main

dump_github-0.2.0/dump_github.egg-info/requires.txt

@@ -0,0 +1,5 @@
+requests>=2.28
+
+[dev]
+build>=1.2
+twine>=5

dump_github-0.2.0/dump_github.egg-info/top_level.txt

@@ -0,0 +1 @@
+dump_github

dump_github-0.2.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "dump-github"
+dynamic = ["version"]
+description = "Back up users' GitHub repositories in case they need them later."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "core2002", email = "core2002@aliyun.com" }]
+keywords = ["github", "backup", "repositories", "cli"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Version Control :: Git",
+    "Topic :: System :: Archiving :: Backup",
+]
+dependencies = ["requests>=2.28"]
+
+[project.optional-dependencies]
+dev = ["build>=1.2", "twine>=5"]
+
+[project.urls]
+Homepage = "https://github.com/Core2002/dump_github"
+Repository = "https://github.com/Core2002/dump_github"
+Issues = "https://github.com/Core2002/dump_github/issues"
+Changelog = "https://github.com/Core2002/dump_github/blob/main/CHANGELOG.md"
+
+[project.scripts]
+dump-github = "dump_github:main"
+
+[tool.setuptools.packages.find]
+include = ["dump_github*"]
+
+[tool.setuptools.dynamic]
+version = { attr = "dump_github._version.__version__" }

dump_github-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

dump_github-0.2.0/tests/test_lib.py

@@ -0,0 +1,294 @@
+import os
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from dump_github import lib
+
+
+class FakeResponse:
+    def __init__(self, status_code, payload):
+        self.status_code = status_code
+        self._payload = payload
+
+    def json(self):
+        return self._payload
+
+
+def make_repo(owner, name):
+    return {
+        "name": name,
+        "full_name": "{}/{}".format(owner, name),
+        "owner": {"login": owner},
+        "clone_url": "https://github.com/{}/{}.git".format(owner, name),
+    }
+
+
+class ListingTests(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+
+    @staticmethod
+    def _matches(url, prefix):
+        return (
+            url == prefix
+            or url.startswith(prefix + "?")
+            or url.startswith(prefix + "/")
+        )
+
+    def route(self, routes):
+        """requests.get replacement: records calls, matches exact URL or prefix."""
+
+        def fake_get(url, headers=None, timeout=None):
+            self.calls.append((url, headers or {}))
+            for prefix, payload in routes:
+                if self._matches(url, prefix):
+                    return FakeResponse(200, payload)
+            return FakeResponse(404, {"message": "Not Found"})
+
+        return fake_get
+
+    def urls(self):
+        return [url for url, _ in self.calls]
+
+    def repos_calls(self):
+        return [(url, headers) for url, headers in self.calls if "/repos?" in url]
+
+    def test_token_own_account_lists_only_owned_repos(self):
+        routes = [
+            ("https://api.github.com/user/repos", [
+                make_repo("alice", "private-project"),
+                make_repo("acme-org", "org-project"),  # must never leak through
+            ]),
+            ("https://api.github.com/users/alice",
+             {"login": "alice", "type": "User"}),
+            ("https://api.github.com/user", {"login": "alice"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("alice", token="ghp_test")
+
+        self.assertEqual([repo["name"] for repo in repos], ["private-project"])
+        self.assertFalse(any("/users/alice/repos" in url for url in self.urls()))
+        own = [url for url in self.urls() if "/user/repos" in url]
+        self.assertEqual(len(own), 1)
+        self.assertIn("affiliation=owner", own[0])
+        self.assertTrue(
+            all(
+                headers.get("Authorization") == "Bearer ghp_test"
+                for _, headers in self.calls
+            )
+        )
+
+    def test_token_for_another_user_uses_username_endpoint(self):
+        routes = [
+            ("https://api.github.com/users/alice/repos", [
+                make_repo("alice", "alice-repo"),
+                make_repo("acme-org", "org-project"),
+            ]),
+            ("https://api.github.com/users/alice",
+             {"login": "alice", "type": "User"}),
+            ("https://api.github.com/user", {"login": "bob"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("alice", token="ghp_test")
+
+        self.assertEqual([repo["name"] for repo in repos], ["alice-repo"])
+        self.assertIn(
+            "https://api.github.com/users/alice/repos?type=owner&per_page=100&page=1",
+            self.urls(),
+        )
+        self.assertFalse(any("/user/repos" in url for url in self.urls()))
+        repos_calls = self.repos_calls()
+        self.assertEqual(len(repos_calls), 1)
+        self.assertEqual(
+            repos_calls[0][1]["Authorization"], "Bearer ghp_test"
+        )
+
+    def test_no_token_uses_public_user_endpoint_without_auth(self):
+        routes = [
+            ("https://api.github.com/users/alice/repos", [
+                make_repo("alice", "alice-repo"),
+            ]),
+            ("https://api.github.com/users/alice",
+             {"login": "alice", "type": "User"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("alice")
+
+        self.assertEqual([repo["name"] for repo in repos], ["alice-repo"])
+        self.assertEqual(
+            self.urls(),
+            [
+                "https://api.github.com/users/alice",
+                "https://api.github.com/users/alice/repos?type=owner&per_page=100&page=1",
+            ],
+        )
+        self.assertTrue(
+            all("Authorization" not in headers for _, headers in self.calls)
+        )
+
+    def test_pagination_stops_on_short_page_and_resolves_once(self):
+        first_page = [make_repo("alice", "repo-{}".format(i)) for i in range(100)]
+        routes = [
+            ("https://api.github.com/user/repos?affiliation=owner&per_page=100&page=1",
+             first_page),
+            ("https://api.github.com/user/repos?affiliation=owner&per_page=100&page=2",
+             [make_repo("alice", "last-repo")]),
+            ("https://api.github.com/users/alice",
+             {"login": "alice", "type": "User"}),
+            ("https://api.github.com/user", {"login": "alice"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("alice", token="ghp_test")
+
+        self.assertEqual(len(repos), 101)
+        self.assertEqual(sum(1 for url in self.urls() if url.endswith("/user")), 1)
+        self.assertEqual(
+            sum(1 for url in self.urls() if url.endswith("/users/alice")), 1
+        )
+        self.assertFalse(any("page=3" in url for url in self.urls()))
+
+    def test_username_is_url_quoted(self):
+        routes = [
+            ("https://api.github.com/users/some%20user/repos", []),
+            ("https://api.github.com/users/some%20user",
+             {"login": "some user", "type": "User"}),
+        ]
+
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            lib.get_page_of_repos("some user", 1)
+
+        self.assertEqual(
+            self.urls()[0], "https://api.github.com/users/some%20user"
+        )
+        self.assertIn(
+            "https://api.github.com/users/some%20user/repos", self.urls()[1]
+        )
+
+    def test_page_of_repos_filters_foreign_owners(self):
+        routes = [
+            ("https://api.github.com/users/alice/repos", [
+                make_repo("alice", "mine"),
+                make_repo("acme-org", "not-mine"),
+            ]),
+            ("https://api.github.com/users/alice",
+             {"login": "alice", "type": "User"}),
+            ("https://api.github.com/user", {"login": "bob"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.get_page_of_repos("alice", 1, token="ghp_test")
+
+        self.assertEqual([repo["name"] for repo in repos], ["mine"])
+
+    def test_organization_with_token_uses_org_endpoint_and_filters(self):
+        routes = [
+            ("https://api.github.com/orgs/acme-org/repos", [
+                make_repo("acme-org", "org-private"),
+                make_repo("alice", "alice-personal"),  # must never leak through
+            ]),
+            ("https://api.github.com/users/acme-org",
+             {"login": "acme-org", "type": "Organization"}),
+            ("https://api.github.com/user", {"login": "alice"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("acme-org", token="ghp_test")
+
+        self.assertEqual([repo["name"] for repo in repos], ["org-private"])
+        self.assertIn(
+            "https://api.github.com/orgs/acme-org/repos?type=all&per_page=100&page=1",
+            self.urls(),
+        )
+        self.assertFalse(any("/users/acme-org/repos" in url for url in self.urls()))
+        self.assertFalse(any("/user/repos" in url for url in self.urls()))
+        repos_calls = self.repos_calls()
+        self.assertEqual(len(repos_calls), 1)
+        self.assertEqual(
+            repos_calls[0][1]["Authorization"], "Bearer ghp_test"
+        )
+
+    def test_organization_without_token_uses_org_endpoint(self):
+        routes = [
+            ("https://api.github.com/orgs/acme-org/repos", [
+                make_repo("acme-org", "org-public"),
+            ]),
+            ("https://api.github.com/users/acme-org",
+             {"login": "acme-org", "type": "Organization"}),
+        ]
+        with mock.patch.object(lib.requests, "get", self.route(routes)):
+            repos = lib.search_user_repos("acme-org")
+
+        self.assertEqual([repo["name"] for repo in repos], ["org-public"])
+        self.assertEqual(
+            self.urls(),
+            [
+                "https://api.github.com/users/acme-org",
+                "https://api.github.com/orgs/acme-org/repos?type=all&per_page=100&page=1",
+            ],
+        )
+        self.assertTrue(
+            all("Authorization" not in headers for _, headers in self.calls)
+        )
+
+    def test_organization_detected_via_org_endpoint_fallback(self):
+        def fake_get(url, headers=None, timeout=None):
+            self.calls.append((url, headers or {}))
+            if url.startswith("https://api.github.com/users/acme-org"):
+                return FakeResponse(404, {"message": "Not Found"})
+            if url == "https://api.github.com/orgs/acme-org":
+                return FakeResponse(200, {"login": "acme-org"})
+            if url.startswith("https://api.github.com/orgs/acme-org/repos"):
+                return FakeResponse(200, [
+                    make_repo("acme-org", "org-repo"),
+                    make_repo("bob", "bob-repo"),
+                ])
+            return FakeResponse(404, {})
+
+        with mock.patch.object(lib.requests, "get", fake_get):
+            repos = lib.search_user_repos("acme-org")
+
+        self.assertEqual([repo["name"] for repo in repos], ["org-repo"])
+        self.assertIn(
+            "https://api.github.com/orgs/acme-org/repos?type=all&per_page=100&page=1",
+            self.urls(),
+        )
+
+    def test_unknown_account_type_falls_back_to_user_endpoint(self):
+        def fake_get(url, headers=None, timeout=None):
+            self.calls.append((url, headers or {}))
+            if url.startswith("https://api.github.com/users/foo/repos"):
+                return FakeResponse(200, [
+                    make_repo("foo", "foo-repo"),
+                    make_repo("bar", "bar-repo"),
+                ])
+            return FakeResponse(404, {})
+
+        with mock.patch.object(lib.requests, "get", fake_get):
+            repos = lib.search_user_repos("foo")
+
+        self.assertEqual([repo["name"] for repo in repos], ["foo-repo"])
+        self.assertIn(
+            "https://api.github.com/users/foo/repos?type=owner&per_page=100&page=1",
+            self.urls(),
+        )
+
+    def test_login_lookup_failure_still_uses_username_endpoint(self):
+        def fake_get(url, headers=None, timeout=None):
+            self.calls.append((url, headers or {}))
+            if url == "https://api.github.com/user":
+                return FakeResponse(500, {"message": "boom"})
+            if url == "https://api.github.com/users/alice":
+                return FakeResponse(200, {"login": "alice", "type": "User"})
+            if url.startswith("https://api.github.com/users/alice/repos"):
+                return FakeResponse(200, [make_repo("alice", "public-repo")])
+            return FakeResponse(404, {})
+
+        with mock.patch.object(lib.requests, "get", fake_get):
+            repos = lib.search_user_repos("alice", token="ghp_test")
+
+        self.assertEqual([repo["name"] for repo in repos], ["public-repo"])
+
+
+if __name__ == "__main__":
+    unittest.main()

dump_github-0.2.0/tests/test_main.py

@@ -0,0 +1,104 @@
+import importlib
+import os
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+main = importlib.import_module("dump_github.main")
+
+
+class CloneTests(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+
+    def fake_run(self, cmd, **kwargs):
+        self.calls.append((cmd, kwargs))
+        return mock.Mock(returncode=0)
+
+    def test_token_is_passed_through_env_not_url(self):
+        repo = {"name": "repo", "clone_url": "https://github.com/alice/repo.git"}
+        with mock.patch.object(main.subprocess, "run", self.fake_run):
+            main.clone_repo(repo, token="ghp_secret")
+
+        cmd, kwargs = self.calls[0]
+        self.assertEqual(cmd[0], "git")
+        self.assertIn("clone", cmd)
+        # Existing credential helpers are reset so a stale stored credential
+        # cannot shadow the token supplied here.
+        self.assertEqual(
+            cmd[cmd.index("credential.helper=") - 1], "-c"
+        )
+        self.assertIn(
+            "credential.helper={}".format(main.GIT_CREDENTIAL_HELPER), cmd
+        )
+        self.assertEqual(cmd[-1], "https://github.com/alice/repo.git")
+        self.assertNotIn("ghp_secret", " ".join(cmd))
+        self.assertNotIn("@github.com", cmd[-1])
+        env = kwargs["env"]
+        self.assertEqual(env["DUMP_GITHUB_TOKEN"], "ghp_secret")
+        self.assertEqual(env["GIT_TERMINAL_PROMPT"], "0")
+
+    def test_env_keeps_the_rest_of_the_environment(self):
+        repo = {"name": "repo", "clone_url": "https://github.com/alice/repo.git"}
+        with mock.patch.dict(os.environ, {"KEEP_ME": "yes"}):
+            with mock.patch.object(main.subprocess, "run", self.fake_run):
+                main.clone_repo(repo, token="ghp_secret")
+
+        env = self.calls[0][1]["env"]
+        self.assertEqual(env["KEEP_ME"], "yes")
+        self.assertIsNot(env, os.environ)
+
+    def test_clone_without_token_stays_anonymous(self):
+        repo = {"name": "repo", "clone_url": "https://github.com/alice/repo.git"}
+        with mock.patch.object(main.subprocess, "run", self.fake_run):
+            main.clone_repo(repo)
+
+        cmd, kwargs = self.calls[0]
+        self.assertEqual(cmd, ["git", "clone", "https://github.com/alice/repo.git"])
+        self.assertIsNone(kwargs["env"])
+
+    def test_version_flag(self):
+        import contextlib
+        import io
+
+        buf = io.StringIO()
+        with self.assertRaises(SystemExit) as ctx:
+            with contextlib.redirect_stdout(buf):
+                main.main(["--version"])
+
+        self.assertEqual(ctx.exception.code, 0)
+        self.assertEqual(buf.getvalue().strip(), "dump-github " + main.__version__)
+
+    def test_credential_helper_outputs_the_env_token(self):
+        """Run the real helper snippet through `git credential fill` if git exists."""
+        import shutil
+        import subprocess
+
+        if not shutil.which("git"):
+            self.skipTest("git is not installed")
+
+        result = subprocess.run(
+            [
+                "git",
+                "-c",
+                "credential.helper=",
+                "-c",
+                "credential.helper={}".format(main.GIT_CREDENTIAL_HELPER),
+                "credential",
+                "fill",
+            ],
+            input="protocol=https\nhost=github.com\n\n",
+            capture_output=True,
+            text=True,
+            env={**os.environ, "DUMP_GITHUB_TOKEN": "ghp_secret"},
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("username=x-access-token", result.stdout)
+        self.assertIn("password=ghp_secret", result.stdout)
+        self.assertNotIn("DUMP_GITHUB_TOKEN", result.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()