Merge branch 'main' into kernel-config-fix

snapcraft_legacy/internal/remote_build/_launchpad.py

@@ -19,7 +19,7 @@
 import os
 import shutil
 import time
-from datetime import datetime
+from datetime import datetime, timedelta, timezone
 from typing import Any, Dict, List, Optional, Sequence, Type
 from urllib.parse import unquote, urlsplit
 
@@ -460,11 +460,20 @@ def has_outstanding_build(self) -> bool:
         snap = self._get_snap()
         return snap is not None
 
-    def push_source_tree(self, repo_dir: str) -> str:
-        """Push source tree to Launchpad, returning URL."""
+    def push_source_tree(self, repo_dir: str) -> None:
+        """Push source tree to Launchpad."""
         git_handler = self._gitify_repository(repo_dir)
         lp_repo = self._create_git_repository(force=True)
-        token = lp_repo.issueAccessToken()
+        # This token will only be used once, immediately after issuing it,
+        # so it can have a short expiry time.  It's not a problem if it
+        # expires before the build completes, or even before the push
+        # completes.
+        date_expires = datetime.now(timezone.utc) + timedelta(minutes=1)
+        token = lp_repo.issueAccessToken(
+            description=f"snapcraft remote-build for {self._build_id}",
+            scopes=["repository:push"],
+            date_expires=date_expires.isoformat(),
+        )
 
         url = self.get_git_https_url(token=token)
         stripped_url = self.get_git_https_url(token="<token>")
@@ -478,5 +487,3 @@ def push_source_tree(self, repo_dir: str) -> str:
             command = error.command.replace(token, "<token>")  # type: ignore
             exit_code = error.exit_code  # type: ignore
             raise errors.LaunchpadGitPushError(command=command, exit_code=exit_code)
-
-        return url

tests/legacy/unit/remote_build/test_launchpad.py

@@ -15,6 +15,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import textwrap
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 
 import fixtures
@@ -452,16 +453,28 @@ def test_git_repository_creation(self):
     def test_push_source_tree(self):
         source_testdir = self.useFixture(TestDir())
         repo_dir = source_testdir.path
-
-        self.lpc.push_source_tree(repo_dir)
-
-        self.mock_git_class.assert_has_calls == [
-            mock.call(
-                "https://user:access-token@git.launchpad.net/~user/+git/id/",
-                "HEAD:master",
-                force=True,
-            )
-        ]
+        now = datetime.now(timezone.utc)
+
+        with mock.patch(
+            "snapcraft_legacy.internal.remote_build._launchpad.datetime"
+        ) as mock_datetime:
+            mock_datetime.now = lambda tz: now
+            self.lpc.push_source_tree(repo_dir)
+
+        self.lpc._lp.git_repositories._git.issueAccessToken_mock.assert_called_once_with(
+            description="snapcraft remote-build for id",
+            scopes=["repository:push"],
+            date_expires=(now + timedelta(minutes=1)).isoformat(),
+        )
+        self.mock_git_class.assert_has_calls(
+            [
+                mock.call().push(
+                    "https://user:access-token@git.launchpad.net/~user/+git/id/",
+                    "HEAD:master",
+                    force=True,
+                )
+            ]
+        )
 
     def test_push_source_tree_error(self):
         self.mock_git_class.return_value.push.side_effect = (