Function withPatToken

packages/bumpy/src/commands/ci.ts:37–55

* Temporarily override GH_TOKEN with BUMPY_GH_TOKEN for a gh CLI call. * * When BUMPY_GH_TOKEN is set (e.g. a dedicated bot PAT or GitHub App token), * it is used so that PRs created by bumpy can trigger CI workflows (the * default GITHUB_TOKEN cannot do this). If BUMPY_GH_TOKEN is not available

(fn: () => Promise<T>)

 * (e.g. fork PRs where secrets are hidden), falls back to the default token.
 */
async function withPatToken<T>(fn: () => Promise<T>): Promise<T> {
  const token = process.env.BUMPY_GH_TOKEN;
  if (!token) return fn();
  const originalGhToken = process.env.GH_TOKEN;
  process.env.GH_TOKEN = token;
  try {
    return await fn();
  } catch (err) {
    // Redact token from error messages to prevent leakage in CI logs
    const msg = err instanceof Error ? err.message : String(err);
    throw new Error(msg.replaceAll(token, '***'));
  } finally {
    if (originalGhToken !== undefined) {
      process.env.GH_TOKEN = originalGhToken;
    } else {
      delete process.env.GH_TOKEN;
    }
  }
}

// ---- Validation helpers ----