From f801bfdbd48f8af36c6fdfcf66d99aae1cf310fb Mon Sep 17 00:00:00 2001 From: Snakefin Date: Fri, 24 Jul 2026 15:08:19 +0200 Subject: [PATCH 1/2] fix: avoid associative arrays in authorize-partner-secret.sh for bash 3.2 macOS ships bash 3.2 (last GPLv2 release), which lacks declare -A. Under set -u, the [nl]=... array keys were arithmetic-evaluated as unset variables, failing with "nl: unbound variable" before the script could run. Swap the associative array for a case statement so the script works on macOS's default bash as well as bash 4+ CI runners. Co-Authored-By: Claude Sonnet 5 --- scripts/authorize-partner-secret.sh | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/scripts/authorize-partner-secret.sh b/scripts/authorize-partner-secret.sh index 8526633..1ea5b5b 100755 --- a/scripts/authorize-partner-secret.sh +++ b/scripts/authorize-partner-secret.sh @@ -18,22 +18,21 @@ set -euo pipefail -declare -A MARKET_REPOS=( - [nl]="silverfin/nl_market" - [be]="silverfin/be_market" - [lu]="silverfin/lu_market" - [uk]="silverfin/uk_market" -) +market_repo() { + case "$1" in + nl) echo "silverfin/nl_market" ;; + be) echo "silverfin/be_market" ;; + lu) echo "silverfin/lu_market" ;; + uk) echo "silverfin/uk_market" ;; + *) echo "$1" ;; + esac +} PARTNER_ID="${1:?Usage: $0 [host]}" MARKET="${2:?Usage: $0 [host]}" HOST="${3:-https://bso-staging-beta.staging.getsilverfin.com}" -if [[ -n "${MARKET_REPOS[$MARKET]:-}" ]]; then - REPO="${MARKET_REPOS[$MARKET]}" -else - REPO="$MARKET" -fi +REPO="$(market_repo "$MARKET")" printf '%s' "API key for partner ${PARTNER_ID} (${REPO}): " read -rs API_KEY From e5590cc7287ed4aaa837c35c0cd4f14ed956ca24 Mon Sep 17 00:00:00 2001 From: Michiel Degezelle Date: Fri, 24 Jul 2026 15:15:23 +0200 Subject: [PATCH 2/2] Preflight gh auth check before authorizing a partner Two real hiccups came up authorizing partners on staging: macOS's bash 3.2 (fixed in the parent commit) and a stale/expired gh session that only surfaced as a 401 at the very last step, after already going through the staging login flow. Check gh auth status up front instead and fail fast with the fix steps, and document checking it before starting in the README. Co-Authored-By: Claude Sonnet 5 --- README.md | 9 +++++++-- scripts/authorize-partner-secret.sh | 12 ++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index abaf3dd..53c8211 100644 --- a/README.md +++ b/README.md @@ -295,7 +295,11 @@ One-off setup script that authorizes a partner `api_key` against staging and sto _Prerequisites:_ * `silverfin` CLI installed and on `PATH`. -* `gh` CLI installed and authenticated (`gh auth login`), with write access to the target market repo's secrets. +* `gh` CLI installed and authenticated, with write access to the target market repo's secrets. Check this **before** you get a fresh token below — a bad `gh` session is a common failure mode (expired token, or needing to re-run `gh auth login` after a while): + ```bash + gh auth status + ``` + If that doesn't show a valid logged-in account, run `gh auth login` and check again. The script also checks this itself right before it would need it, and prints these same steps if it isn't set up — but confirming it upfront saves you from going through the staging login flow below only to hit an avoidable failure at the very last step. * A fresh partner `api_key`, obtained via the staging login flow below. Get this **right before** running the script — the token is shown once, in a banner, and you paste it straight into the prompt. _Getting the partner `api_key` (staging login flow):_ @@ -318,7 +322,7 @@ _Usage:_ ``` * `` — numeric partner environment id, e.g. `2`. -* `` — either a short code (`nl`, `be`, `lu`, `uk`, mapped to `silverfin/_market` in the script's `MARKET_REPOS` table) or a full `owner/repo`. +* `` — either a short code (`nl`, `be`, `lu`, `uk`, mapped to `silverfin/_market` by the script's market → repo lookup) or a full `owner/repo`. * `[host]` — optional. Defaults to `https://bso-staging-beta.staging.getsilverfin.com` (the same staging beta host used in the login flow above). Pass an explicit URL to target a different environment, or edit the `HOST` default in the script if you're permanently moving to a new environment. Examples: @@ -332,6 +336,7 @@ Examples: _What it does:_ +* Resolves `` to a repo, then checks `gh auth status` — exits immediately with the `gh auth login` steps above if it's not valid, before asking for anything sensitive. * Prompts for the api key (hidden input). * Creates a throwaway `HOME` directory so the authorization doesn't touch your real `~/.silverfin/config.json`. * Runs `silverfin config --set-host ` and `silverfin authorize-partner -i -k -n partner-` inside that throwaway `HOME`. diff --git a/scripts/authorize-partner-secret.sh b/scripts/authorize-partner-secret.sh index 1ea5b5b..a17aa4f 100755 --- a/scripts/authorize-partner-secret.sh +++ b/scripts/authorize-partner-secret.sh @@ -34,6 +34,18 @@ HOST="${3:-https://bso-staging-beta.staging.getsilverfin.com}" REPO="$(market_repo "$MARKET")" +if ! gh auth status >/dev/null 2>&1; then + cat >&2 <