Walkthrough

Moved OIDC token acquisition from early PushContext construction to immediately after flake evaluation completes. Introduced a TokenContext enum that defers token retrieval by environment type (GitHub, GitLab, Generic, LocalGitHub), then acquires fresh tokens via a new async method just before FlakeHubClient initialization to prevent token expiry during long evaluations.

Changes

Sequence Diagram

sequenceDiagram
    participant Main as Main (execute)
    participant PushCtx as PushContext
    participant TokenMgr as Token Acquisition
    participant FlakeEval as Flake Evaluation
    participant Client as FlakeHubClient
    participant API as FlakeHub API

    Main->>PushCtx: from_cli_and_env()<br/>(stores TokenContext)
    Main->>FlakeEval: Run nix evaluation<br/>(can take 8+ minutes)
    FlakeEval-->>Main: Evaluation complete
    Main->>TokenMgr: acquire_auth_token()
    
    alt GitHub Actions
        TokenMgr->>TokenMgr: get_actions_id_bearer_token()
    else GitLab Runner
        TokenMgr->>TokenMgr: get_runner_bearer_token()
    else Generic
        TokenMgr->>TokenMgr: Read FLAKEHUB_PUSH_OIDC_TOKEN env
    else LocalGitHub
        TokenMgr->>TokenMgr: Generate fake token
        TokenMgr->>TokenMgr: Reset to Generic
    end
    
    TokenMgr-->>Main: (fresh_token, ctx)
    Main->>Client: FlakeHubClient::new(fresh_token)
    Client->>API: /token/status (with fresh token)
    API-->>Client: 200 OK

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰 A token that traveled through time, now refreshed and sublime!
No more 401 heartache—evaluation's done, and we grab it just right.
Fresh OIDC upon the api call's plight! 🥕✨

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• 📝 Generate docstrings

src/push_context.rs (2)

195-257: Consider taking &mut self to avoid the verbose destructure-reconstruct pattern.

The full destructure on lines 199–207 and reconstruct on lines 246–254 exist solely because self is consumed by value. Since only the LocalGitHub arm actually needs to move data out of token_context, you could take &mut self and use std::mem::replace for that case, returning just the String token. This simplifies the caller too (let auth_token = ctx.acquire_auth_token().await?).

♻️ Sketch using &mut self

-    pub async fn acquire_auth_token(self) -> Result<(String, Self)> {
-        let PushContext {
-            flakehub_host,
-            token_context,
-            upload_name,
-            release_version,
-            error_if_release_conflicts,
-            metadata,
-            tarball,
-        } = self;
-
-        let (token, token_context) = match token_context {
-            TokenContext::GitHub { ref host } => {
+    pub async fn acquire_auth_token(&mut self) -> Result<String> {
+        let token = match &self.token_context {
+            TokenContext::GitHub { host } => {
                 let t = crate::github::get_actions_id_bearer_token(host)
                     .await
                     .wrap_err("Getting upload bearer token from GitHub")?;
-                (t, token_context)
+                t
             }
             TokenContext::GitLab => {
                 let t = crate::gitlab::get_runner_bearer_token()
                     .await
                     .wrap_err("Getting upload bearer token from GitLab")?;
-                (t, TokenContext::GitLab)
+                t
             }
             TokenContext::Generic => {
                 let t = std::env::var("FLAKEHUB_PUSH_OIDC_TOKEN")
                     .with_context(|| "missing FLAKEHUB_PUSH_OIDC_TOKEN environment variable")?;
-                (t, TokenContext::Generic)
+                t
             }
-            TokenContext::LocalGitHub {
-                jwt_issuer_uri,
-                project_owner,
-                repository,
-                github_graphql_data_result,
-            } => {
-                let t = flakehub_auth_fake::get_fake_bearer_token(
-                    &jwt_issuer_uri,
-                    &project_owner,
-                    &repository,
-                    github_graphql_data_result,
-                )
-                .await?;
-                (t, TokenContext::Generic)
+            TokenContext::LocalGitHub { .. } => {
+                let old = std::mem::replace(&mut self.token_context, TokenContext::Generic);
+                let TokenContext::LocalGitHub {
+                    jwt_issuer_uri,
+                    project_owner,
+                    repository,
+                    github_graphql_data_result,
+                } = old else { unreachable!() };
+                flakehub_auth_fake::get_fake_bearer_token(
+                    &jwt_issuer_uri,
+                    &project_owner,
+                    &repository,
+                    github_graphql_data_result,
+                )
+                .await?
             }
         };
-
-        let ctx = PushContext {
-            flakehub_host,
-            token_context,
-            upload_name,
-            release_version,
-            error_if_release_conflicts,
-            metadata,
-            tarball,
-        };
-
-        Ok((token, ctx))
+        Ok(token)
     }

---

110-112: host in TokenContext::GitHub duplicates flakehub_host — consider referencing the existing field.

TokenContext::GitHub { host } stores a clone of cli.host (line 111), which is the same value stored in PushContext::flakehub_host (line 175). If you switch acquire_auth_token to &mut self as suggested above, the GitHub arm could simply reference self.flakehub_host directly, removing the need for the host field in TokenContext::GitHub entirely and making it a unit variant like GitLab/Generic.

• X
• Mastodon
• Reddit
• LinkedIn