Coverage for src/gcp_attest/_cli/__init__.py: 74%

1import sys 

2from typing import Sequence 

3from typing import TYPE_CHECKING 

4 

5if TYPE_CHECKING: 

6 import argparse 

7 

8 

9def _get_parser() -> "argparse.ArgumentParser": 

10 import argparse 

11 from importlib.metadata import version 

12 

13 parser = argparse.ArgumentParser( 

14 description="Produce Sigstore digital attestations and use PyPI Trusted Publisher via Google Cloud IAM.", 

15 formatter_class=argparse.ArgumentDefaultsHelpFormatter, 

16 ) 

17 parser.color = True 

18 parser.add_argument( 

19 "--version", 

20 "-V", 

21 action="version", 

22 version=f"gcp-attest version {version('gcp-attest')}", 

23 ) 

24 subparsers = parser.add_subparsers( 

25 dest="subcommand", 

26 required=True, 

27 metavar="COMMAND", 

28 ) 

29 

30 token_parser = subparsers.add_parser( 

31 "token", 

32 help="Issue a Google Cloud OIDC token for the specified audience.", 

33 ) 

34 token_parser.add_argument("audience", help="'aud' claim of the token") 

35 

36 return parser 

37 

38 

39# TODO: the body of this should be its own function 

40def _token(args: argparse.Namespace) -> int | None: 

41 from google.auth.transport.requests import Request 

42 from gcp_attest.credentials import get_id_token_credentials 

43 

44 try: 

45 credentials = get_id_token_credentials(args.audience) 

46 credentials.refresh(Request()) 

47 except Exception as e: 

48 # TODO: proper logging 

49 sys.stderr.write(f"ERROR: {e!s}\n") 

50 return 1 

51 

52 if not credentials.valid: 

53 sys.stderr.write("FATAL: credentials are invalid\n") 

54 return -1 

55 

56 token: str = credentials.token 

57 sys.stdout.write(token) 

58 sys.stdout.write("\n") 

59 sys.stdout.flush() 

60 

61 

62def main(argv: Sequence[str] | None = None) -> int | None: 

63 parser = _get_parser() 

64 args = parser.parse_args(argv) 

65 

66 if args.subcommand == "token": 66 ↛ exitline 66 didn't return from function 'main' because the condition on line 66 was always true

67 return _token(args)