Credentials

Credential injection and environment variable resolution.

Secrets are stored exclusively in environment variables and resolved at runtime via ${VAR} references. No credential value is ever written to logs or exposed in exception messages beyond the variable name.

Classes:

CredentialError –

Raised when a required credential or env var is missing.

Functions:

get_github_token –

Return the GitHub Personal Access Token from the environment.
resolve_env_refs –

Substitute all ${VAR} patterns with their environment variable values.

CredentialError ¶

Bases: Exception

Raised when a required credential or env var is missing.

get_github_token ¶

get_github_token() -> str

Return the GitHub Personal Access Token from the environment.

Returns:

str –

The value of the GITHUB_TOKEN environment variable.

Raises:

CredentialError –

If GITHUB_TOKEN is not set in the environment.

resolve_env_refs ¶

resolve_env_refs(value: str) -> str

Substitute all ${VAR} patterns with their environment variable values.

Parameters:

value (str) –

A string potentially containing ${VAR} references.

Returns:

str –

The string with every reference replaced by the corresponding
str –

environment variable value.

Raises:

CredentialError –

If any referenced variable is absent from the environment. The message names the missing variable but never includes surrounding literal text or any resolved values.