runspec-gitlab-core 0.3.0__tar.gz → 0.4.0__tar.gz

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/.gitignore

@@ -59,3 +59,6 @@ chainlit-docs/
 
 # Stray committed test venv (removed from tracking)
 .venv-test/
+
+# Private gitleaks rules (see .gitleaks.toml)
+.gitleaks.local.toml

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `runspec-gitlab-core` are documented here.
 
+## [0.4.0] — 2026-10-25
+
+- `config_from_env` reads the token from `GITLAB_TOKEN` or `GITLAB_PAT` (each
+  also under the `GITLAB_<ENV>_` prefix) — the two names a runspec-console token
+  credential labelled `GitLab` sets — and takes `url` / `token` keyword
+  overrides that win over the environment.
+- The "No token configured" error also names the console credential route.
+
 ## [0.3.0]
 
 Write helpers, each taking a `GitlabConfig` first like the reads.

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-gitlab-core
-Version: 0.3.0
+Version: 0.4.0
 Summary: Pure-Python GitLab REST helpers — the importable core behind runspec-gitlab (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Requires-Dist: httpx

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-gitlab-core"
-version = "0.3.0"
+version = "0.4.0"
 requires-python = ">=3.10"
 description = "Pure-Python GitLab REST helpers — the importable core behind runspec-gitlab (no runspec dependency, no runnables)"
 dependencies = [

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/runspec_gitlab_core/client.py

@@ -7,7 +7,7 @@ credentials and call the same functions the CLI runnable's verbs call.
 
 Auth is environment-variable driven (see :func:`config_from_env`) but a caller is
 free to build a :class:`GitlabConfig` by hand. A single personal-access token
-(``GITLAB_TOKEN``) is sent as the ``PRIVATE-TOKEN`` header; the instance URL
+(``GITLAB_TOKEN`` or ``GITLAB_PAT``) is sent as the ``PRIVATE-TOKEN`` header; the instance URL
 (``GITLAB_URL``) defaults to ``https://gitlab.com`` for the SaaS case.
 
 This mirrors the read tools of GitLab's own (hosted) MCP server, but ports them
@@ -65,13 +65,16 @@ def _env_first(names: list[str]) -> str | None:
     return None
 
 
-def config_from_env(env: str | None = None) -> GitlabConfig:
+def config_from_env(env: str | None = None, *, url: str | None = None, token: str | None = None) -> GitlabConfig:
     """Build a :class:`GitlabConfig` from environment variables.
 
     When ``env`` (or the ``GITLAB_ENV`` variable) selects dev/uat/prod, the
     environment-prefixed variables are read first (e.g. ``GITLAB_UAT_TOKEN``),
     falling back to the unprefixed ``GITLAB_*`` family for single-instance
-    setups. ``GITLAB_URL`` defaults to ``https://gitlab.com`` when unset. Raises
+    setups. The token is read from ``GITLAB_TOKEN`` or ``GITLAB_PAT`` (the two
+    names a runspec-console token credential labelled ``GitLab`` sets).
+    ``GITLAB_URL`` defaults to ``https://gitlab.com`` when unset. Explicit
+    ``url`` / ``token`` arguments win over the environment. Raises
     :class:`GitlabError` with an actionable message when the env label is invalid
     or the token is missing.
     """
@@ -81,19 +84,19 @@ def config_from_env(env: str | None = None) -> GitlabConfig:
         if env not in VALID_ENVS:
             raise GitlabError(f"Invalid env {env!r} — expected one of {', '.join(VALID_ENVS)}")
 
-    def lookup(suffix: str) -> str | None:
+    def lookup(*suffixes: str) -> str | None:
         names = []
         if env:
-            names.append(f"GITLAB_{env.upper()}_{suffix}")
-        names.append(f"GITLAB_{suffix}")
+            names += [f"GITLAB_{env.upper()}_{suffix}" for suffix in suffixes]
+        names += [f"GITLAB_{suffix}" for suffix in suffixes]
         return _env_first(names)
 
-    token = lookup("TOKEN")
+    token = token or lookup("TOKEN", "PAT")
     if not token:
         hint = f"GITLAB_{env.upper()}_TOKEN" if env else "GITLAB_TOKEN"
-        raise GitlabError(f"No token configured — set {hint} (a GitLab personal access token)")
+        raise GitlabError(f"No token configured — set {hint} (a GitLab personal access token), or add a runspec-console token credential labelled GitLab")
 
-    base_url = lookup("URL") or DEFAULT_URL
+    base_url = url or lookup("URL") or DEFAULT_URL
 
     return GitlabConfig(
         base_url=base_url.rstrip("/"),

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/tests/conftest.py

@@ -9,7 +9,7 @@ import pytest
 
 from runspec_gitlab_core import client as client_mod
 
-_SUFFIXES = ("URL", "TOKEN", "PROJECT")
+_SUFFIXES = ("URL", "TOKEN", "PAT", "PROJECT")
 _ALL_VARS = ["GITLAB_ENV"] + [f"GITLAB_{s}" for s in _SUFFIXES]
 for _env in ("DEV", "UAT", "PROD"):
     _ALL_VARS += [f"GITLAB_{_env}_{s}" for s in _SUFFIXES]

{runspec_gitlab_core-0.3.0 → runspec_gitlab_core-0.4.0}/tests/test_client.py

@@ -68,6 +68,30 @@ def test_missing_token_raises(monkeypatch):
 # ── encode_project ──────────────────────────────────────────────────────────
 
 
+def test_token_read_from_gitlab_pat(monkeypatch):
+    # A runspec-console token credential labelled "GitLab" sets GITLAB_TOKEN and GITLAB_PAT.
+    monkeypatch.setenv("GITLAB_PAT", "pat-tok")
+    assert config_from_env().token == "pat-tok"
+
+
+def test_env_prefixed_pat_beats_unprefixed_token(monkeypatch):
+    monkeypatch.setenv("GITLAB_TOKEN", "shared")
+    monkeypatch.setenv("GITLAB_UAT_PAT", "uat-pat")
+    assert config_from_env(env="uat").token == "uat-pat"
+
+
+def test_explicit_url_and_token_win(monkeypatch):
+    monkeypatch.setenv("GITLAB_TOKEN", "env-tok")
+    monkeypatch.setenv("GITLAB_URL", "https://env.example.com")
+    cfg = config_from_env(url="https://cli.example.com/", token="cli-tok")
+    assert (cfg.base_url, cfg.token) == ("https://cli.example.com", "cli-tok")
+
+
+def test_missing_token_names_the_console_credential(monkeypatch):
+    with pytest.raises(GitlabError, match="credential labelled GitLab"):
+        config_from_env()
+
+
 def test_encode_project_path():
     assert encode_project("group/sub/app") == "group%2Fsub%2Fapp"