Set HOMEBREW_API_TOKEN from Git when available.

As requested in Homebrew/homebrew#46578. Falls back to existing functionality.

Closes Homebrew/homebrew#46578.

Closes Homebrew/homebrew#49846.

Signed-off-by: Mike McQuaid <mike@mikemcquaid.com>

4 files changed, 40 insertions, 20 deletions

diff --git a/Library/Homebrew/cmd/gist-logs.rb b/Library/Homebrew/cmd/gist-logs.rb
index 29deb6551..acc9a10ea 100644
--- a/Library/Homebrew/cmd/gist-logs.rb
+++ b/Library/Homebrew/cmd/gist-logs.rb
@@ -37,7 +37,7 @@ module Homebrew
     if ARGV.include?("--new-issue") || ARGV.switch?("n")
       auth = :AUTH_TOKEN
 
-      unless HOMEBREW_GITHUB_API_TOKEN
+      unless GitHub.api_credentials
         puts "You can create a personal access token: https://github.com/settings/tokens"
         puts "and then set HOMEBREW_GITHUB_API_TOKEN as authentication method."
         puts
@@ -115,15 +115,8 @@ module Homebrew
   end
 
   def make_request(path, data, auth)
-    headers = {
-      "User-Agent"   => HOMEBREW_USER_AGENT,
-      "Accept"       => "application/vnd.github.v3+json",
-      "Content-Type" => "application/json"
-    }
-
-    if auth == :AUTH_TOKEN || (auth.nil? && HOMEBREW_GITHUB_API_TOKEN)
-      headers["Authorization"] = "token #{HOMEBREW_GITHUB_API_TOKEN}"
-    end
+    headers = GitHub.api_headers
+    headers["Content-Type"] = "application/json"
 
     request = Net::HTTP::Post.new(path, headers)
 
diff --git a/Library/Homebrew/global.rb b/Library/Homebrew/global.rb
index 00028acad..c8fec75e4 100644
--- a/Library/Homebrew/global.rb
+++ b/Library/Homebrew/global.rb
@@ -26,7 +26,6 @@ else
 end
 RUBY_BIN = RUBY_PATH.dirname
 
-HOMEBREW_GITHUB_API_TOKEN = ENV["HOMEBREW_GITHUB_API_TOKEN"]
 HOMEBREW_USER_AGENT = "Homebrew #{HOMEBREW_VERSION} (Ruby #{RUBY_VERSION}-#{RUBY_PATCHLEVEL}; #{OS_VERSION})"
 
 HOMEBREW_CURL_ARGS = "-f#LA"
diff --git a/Library/Homebrew/test/test_tap.rb b/Library/Homebrew/test/test_tap.rb
index 56c87de83..18fe8709d 100644
--- a/Library/Homebrew/test/test_tap.rb
+++ b/Library/Homebrew/test/test_tap.rb
@@ -155,7 +155,7 @@ class TapTest < Homebrew::TestCase
   end
 
   def test_private_remote
-    skip "HOMEBREW_GITHUB_API_TOKEN is required" unless ENV["HOMEBREW_GITHUB_API_TOKEN"]
+    skip "HOMEBREW_GITHUB_API_TOKEN is required" unless GitHub.api_credentials
     assert_predicate @tap, :private?
   end
 
diff --git a/Library/Homebrew/utils.rb b/Library/Homebrew/utils.rb
index e020caef0..d3f92d523 100644
--- a/Library/Homebrew/utils.rb
+++ b/Library/Homebrew/utils.rb
@@ -506,21 +506,49 @@ module GitHub
     end
   end
 
+  def api_credentials
+    @api_credentials ||= begin
+      if ENV["HOMEBREW_GITHUB_API_TOKEN"]
+        ENV["HOMEBREW_GITHUB_API_TOKEN"]
+      else
+        github_credentials = IO.popen(["git", "credential-osxkeychain", "get"], "w+") do |io|
+          io.puts "protocol=https\nhost=github.com"
+          io.close_write
+          io.read
+        end
+        github_username = github_credentials[/username=(.+)/, 1]
+        github_password = github_credentials[/password=(.+)/, 1]
+        [github_password, github_username] if github_username && github_password
+      end
+    end
+  end
+
+  def api_headers
+    @api_headers ||= begin
+        headers = {
+        "User-Agent" => HOMEBREW_USER_AGENT,
+        "Accept"     => "application/vnd.github.v3+json"
+      }
+      token, username = api_credentials
+      if token && !token.empty?
+        if username && !username.empty?
+          headers[:http_basic_authentication] = [username, token]
+        else
+          headers["Authorization"] = "token #{token}"
+        end
+      end
+      headers
+    end
+  end
+
   def open(url, &_block)
     # This is a no-op if the user is opting out of using the GitHub API.
     return if ENV["HOMEBREW_NO_GITHUB_API"]
 
     require "net/https"
 
-    headers = {
-      "User-Agent" => HOMEBREW_USER_AGENT,
-      "Accept"     => "application/vnd.github.v3+json"
-    }
-
-    headers["Authorization"] = "token #{HOMEBREW_GITHUB_API_TOKEN}" if HOMEBREW_GITHUB_API_TOKEN
-
     begin
-      Kernel.open(url, headers) { |f| yield Utils::JSON.load(f.read) }
+      Kernel.open(url, api_headers) { |f| yield Utils::JSON.load(f.read) }
     rescue OpenURI::HTTPError => e
       handle_api_error(e)
     rescue EOFError, SocketError, OpenSSL::SSL::SSLError => e