Update app.py

app.py

@@ -1,155 +1,301 @@
 #!/usr/bin/env python3
 """
 Hugging Face Space Entry Point
-This script clones the GitHub repository and runs the actual app from it.
-This way, git operations in the app target the GitHub repo, not the HF Space.
-"""
+================================
+This script clones a GitHub repository and runs the application from it.
+This architecture ensures git operations target the GitHub repo, not the HF Space.
 
+Architecture:
+- HF Space contains only this entry point
+- Actual application code lives in GitHub repository
+- Git operations are patched to target the cloned GitHub repo
+- File operations (like leaderboard.csv) happen in the GitHub repo directory
 
+Security:
+- All sensitive information is masked in logs
+- Tokens are never printed or exposed
+"""
 
 import os
 import subprocess
 import sys
+import re
 from pathlib import Path
 
-def run_command(cmd, check=True, cwd=None):
-    """Run a command and handle errors"""
-    print(f"Running: {' '.join(cmd) if isinstance(cmd, list) else cmd}")
+
+def mask_sensitive_info(text):
+    """
+    Mask sensitive information in text for safe logging.
+    
+    Args:
+        text: String that may contain sensitive information
+        
+    Returns:
+        String with sensitive information masked
+    """
+    if text is None:
+        return text
+    
+    # Mask various token patterns
+    patterns = [
+        (r'ghp_[a-zA-Z0-9]{36,}', 'ghp_***'),           # GitHub Personal Access Token
+        (r'github_pat_[a-zA-Z0-9_]{82,}', 'github_pat_***'),  # GitHub PAT (new format)
+        (r'hf_[a-zA-Z0-9]{20,}', 'hf_***'),             # Hugging Face token
+        (r'://[^:@]+:[^:@]+@', '://***:***@'),          # URLs with credentials
+    ]
+    
+    masked = text
+    for pattern, replacement in patterns:
+        masked = re.sub(pattern, replacement, masked)
+    
+    return masked
+
+
+def run_command(cmd, check=True, cwd=None, capture_output=True):
+    """
+    Execute a shell command with error handling and secure logging.
+    
+    Args:
+        cmd: Command to execute (list or string)
+        check: Whether to raise exception on non-zero exit
+        cwd: Working directory for the command
+        capture_output: Whether to capture stdout/stderr
+        
+    Returns:
+        subprocess.CompletedProcess object
+    """
+    # Format command for display
+    cmd_display = ' '.join(cmd) if isinstance(cmd, list) else cmd
+    print(f"Running: {mask_sensitive_info(cmd_display)}")
+    
     try:
         result = subprocess.run(
             cmd if isinstance(cmd, list) else cmd.split(),
             check=check,
-            capture_output=True,
+            capture_output=capture_output,
             text=True,
             cwd=cwd
         )
-        if result.stdout:
-            print(result.stdout)
-        if result.stderr:
-            print(result.stderr, file=sys.stderr)
+        
+        # Print output with sensitive info masked
+        if result.stdout and capture_output:
+            print(mask_sensitive_info(result.stdout))
+        if result.stderr and capture_output:
+            print(mask_sensitive_info(result.stderr), file=sys.stderr)
+            
         return result
+        
     except subprocess.CalledProcessError as e:
-        print(f"Error: {e}")
+        print(f"❌ Command failed with exit code {e.returncode}")
         if e.stdout:
-            print(f"stdout: {e.stdout}")
+            print(f"stdout: {mask_sensitive_info(e.stdout)}")
         if e.stderr:
-            print(f"stderr: {e.stderr}")
+            print(f"stderr: {mask_sensitive_info(e.stderr)}")
         raise
 
-def setup_and_run():
-    """Clone GitHub repo and run the app"""
-    
-    # Configuration
-    GITHUB_USER = os.getenv('GITHUB_USER', 'sudoping01')
-    GITHUB_REPO = os.getenv('GITHUB_REPO', 'MALIBA-AI/bambara-asr-leaderboard')
-    GITHUB_TOKEN = os.getenv('GITHUB_TOKEN', '')
-    GITHUB_EMAIL = os.getenv('GITHUB_EMAIL', '[email protected]')
-    
-    # Ensure HF_TOKEN is set (even if empty string) to avoid Pydantic validation error
-    if 'HF_TOKEN' not in os.environ:
-        os.environ['HF_TOKEN'] = ''
-    
-    # Directory structure
-    repo_dir = Path("/tmp/github_repo")
-    app_dir = repo_dir / "space"
-    
-    print("=" * 50)
-    print("Hugging Face Space - GitHub Integration Setup")
-    print("=" * 50)
+
+def setup_github_repo(repo_dir, github_user, github_repo, github_token, github_email):
+    """
+    Clone or update the GitHub repository.
     
-    # Clone or update repository
+    Args:
+        repo_dir: Path where repo should be cloned
+        github_user: GitHub username
+        github_repo: Repository in format 'owner/repo'
+        github_token: GitHub authentication token (optional)
+        github_email: Email for git config
+        
+    Returns:
+        True if successful, False otherwise
+    """
     if not repo_dir.exists():
-        print(f"\n📦 Cloning repository: {GITHUB_REPO}")
+        print(f"\n📦 Cloning repository: {github_repo}")
         
-        if GITHUB_TOKEN:
-            # Use token for authentication
-            repo_url = f"https://{GITHUB_USER}:{GITHUB_TOKEN}@github.com/{GITHUB_REPO}.git"
+        # Build repository URL
+        if github_token and github_token.strip():
+            repo_url = f"https://{github_user}:{github_token}@github.com/{github_repo}.git"
         else:
-            # Public repo or using other auth methods
-            repo_url = f"https://github.com/{GITHUB_REPO}.git"
+            # Public repo fallback
+            repo_url = f"https://github.com/{github_repo}.git"
         
+        # Clone repository
         run_command(["git", "clone", repo_url, str(repo_dir)])
         
-        # Configure git in the cloned repo
-        run_command(["git", "config", "user.email", GITHUB_EMAIL], cwd=repo_dir)
-        run_command(["git", "config", "user.name", GITHUB_USER], cwd=repo_dir)
+        # Configure git user
+        run_command(["git", "config", "user.email", github_email], cwd=repo_dir)
+        run_command(["git", "config", "user.name", github_user], cwd=repo_dir)
         
-        # Set up remote URL with token if available
-        if GITHUB_TOKEN:
-            remote_url = f"https://{GITHUB_USER}:{GITHUB_TOKEN}@github.com/{GITHUB_REPO}.git"
+        # Set remote URL with token for push operations
+        if github_token and github_token.strip():
+            remote_url = f"https://{github_user}:{github_token}@github.com/{github_repo}.git"
             run_command(["git", "remote", "set-url", "origin", remote_url], cwd=repo_dir)
+            
+        print("✅ Repository cloned successfully")
+        
     else:
         print(f"\n🔄 Repository exists, pulling latest changes...")
-        run_command(["git", "pull"], cwd=repo_dir, check=False)
+        result = run_command(["git", "pull"], cwd=repo_dir, check=False)
+        
+        if result.returncode == 0:
+            print("✅ Repository updated successfully")
+        else:
+            print("⚠️ Git pull failed, continuing with existing version")
     
-    # Verify the space directory exists
+    return True
+
+
+def setup_environment(app_dir, repo_dir):
+    """
+    Set up the Python environment and install dependencies.
+    
+    Args:
+        app_dir: Path to the application directory
+        repo_dir: Path to the repository root
+    """
+    # Install requirements
+    requirements_file = app_dir / "requirements.txt"
+    if requirements_file.exists():
+        print("\n📚 Installing requirements...")
+        run_command([sys.executable, "-m", "pip", "install", "-r", str(requirements_file)])
+        print("✅ Requirements installed successfully")
+    else:
+        print("⚠️ No requirements.txt found, skipping dependency installation")
+    
+    # Set environment variables for file paths
+    # This ensures files like leaderboard.csv are created in the GitHub repo
+    os.environ['LEADERBOARD_FILE'] = str(repo_dir / "leaderboard.csv")
+    
+    # Add app directory to Python path
+    sys.path.insert(0, str(app_dir))
+
+
+def patch_git_operations(repo_dir):
+    """
+    Monkey-patch subprocess.run to ensure git commands target the GitHub repo.
+    
+    This prevents git operations from accidentally targeting the HF Space repo.
+    
+    Args:
+        repo_dir: Path to the GitHub repository
+    """
+    import subprocess as orig_subprocess
+    
+    original_run = orig_subprocess.run
+    
+    def patched_run(cmd, *args, **kwargs):
+        """Patched subprocess.run that redirects git commands to repo_dir"""
+        
+        # Check if this is a git command
+        is_git_command = False
+        if isinstance(cmd, list) and len(cmd) > 0 and cmd[0] == 'git':
+            is_git_command = True
+        elif isinstance(cmd, str) and cmd.strip().startswith('git'):
+            is_git_command = True
+        
+        # If git command and no cwd specified, use repo_dir
+        if is_git_command and 'cwd' not in kwargs:
+            kwargs['cwd'] = str(repo_dir)
+            print(f"[Git Patch] Redirecting git command to: {mask_sensitive_info(str(repo_dir))}")
+        
+        return original_run(cmd, *args, **kwargs)
+    
+    # Apply the patch
+    orig_subprocess.run = patched_run
+    print("✅ Git operations patched successfully")
+
+
+def setup_and_run():
+    """
+    Main setup function: clone repo, configure environment, and run the app.
+    """
+    
+    # Load configuration from environment variables
+    GITHUB_USER = os.getenv('GITHUB_USER', 'sudoping01')
+    GITHUB_REPO = os.getenv('GITHUB_REPO', 'MALIBA-AI/bambara-asr-leaderboard')
+    GITHUB_TOKEN = os.getenv('GITHUB_TOKEN', '')
+    GITHUB_EMAIL = os.getenv('GITHUB_EMAIL', '[email protected]')
+    
+    # Define directory structure
+    repo_dir = Path("/tmp/github_repo")
+    app_dir = repo_dir / "space"
+    
+    # Print startup banner
+    print("=" * 60)
+    print("  Hugging Face Space - GitHub Integration Setup")
+    print("=" * 60)
+    print(f"Repository: {GITHUB_REPO}")
+    print(f"Target directory: {repo_dir}")
+    print("=" * 60)
+    
+    # Step 1: Setup GitHub repository
+    try:
+        setup_github_repo(repo_dir, GITHUB_USER, GITHUB_REPO, GITHUB_TOKEN, GITHUB_EMAIL)
+    except Exception as e:
+        print(f"\n❌ Failed to setup GitHub repository: {e}")
+        sys.exit(1)
+    
+    # Step 2: Verify app directory exists
     if not app_dir.exists():
         print(f"\n❌ Error: 'space' directory not found in {repo_dir}")
         print("Available directories:")
         for item in repo_dir.iterdir():
             print(f"  - {item.name}")
+        print("\nPlease ensure your repository has a 'space' directory with the application code.")
         sys.exit(1)
     
-    print(f"\n✅ App directory found: {app_dir}")
+    print(f"✅ Application directory found: {app_dir}")
     
-    # Change to app directory
+    # Step 3: Change to app directory
     os.chdir(app_dir)
-    print(f"Working directory: {os.getcwd()}")
+    print(f"✅ Working directory: {os.getcwd()}")
     
-    # Install requirements if they exist
-    requirements_file = app_dir / "requirements.txt"
-    if requirements_file.exists():
-        print("\n📚 Installing requirements...")
-        run_command([sys.executable, "-m", "pip", "install", "-r", str(requirements_file)])
+    # Step 4: Setup environment
+    try:
+        setup_environment(app_dir, repo_dir)
+    except Exception as e:
+        print(f"\n❌ Failed to setup environment: {e}")
+        sys.exit(1)
     
-    # IMPORTANT: Update settings to point to the GitHub repo directory
-    # This ensures all file operations (like leaderboard.csv) happen in the GitHub repo
-    os.environ['LEADERBOARD_FILE'] = str(repo_dir / "leaderboard.csv")
+    # Step 5: Patch git operations
+    try:
+        patch_git_operations(repo_dir)
+    except Exception as e:
+        print(f"\n⚠️ Failed to patch git operations: {e}")
+        print("Continuing anyway...")
     
-    # Run the actual app
+    # Step 6: Run the application
     app_file = app_dir / "app.py"
-    if app_file.exists():
-        print("\n🚀 Starting application...")
-        print("=" * 50)
-        
-        # Import and run the app
-        sys.path.insert(0, str(app_dir))
-        
-        # Import the necessary modules to patch git operations
-        import subprocess as orig_subprocess
-        
-        # Monkey-patch subprocess to run git commands in the repo directory
-        original_run = orig_subprocess.run
-        
-        def patched_run(cmd, *args, **kwargs):
-            # If it's a git command and no cwd is specified, use repo_dir
-            if isinstance(cmd, list) and len(cmd) > 0 and cmd[0] == 'git':
-                if 'cwd' not in kwargs:
-                    kwargs['cwd'] = str(repo_dir)
-                    print(f"[Git patch] Running git command in: {kwargs['cwd']}")
-            elif isinstance(cmd, str) and cmd.startswith('git'):
-                if 'cwd' not in kwargs:
-                    kwargs['cwd'] = str(repo_dir)
-                    print(f"[Git patch] Running git command in: {kwargs['cwd']}")
-            return original_run(cmd, *args, **kwargs)
-        
-        # Apply the patch
-        orig_subprocess.run = patched_run
-        
-        # Execute the app
+    if not app_file.exists():
+        print(f"\n❌ Error: app.py not found in {app_dir}")
+        sys.exit(1)
+    
+    print("\n" + "=" * 60)
+    print("  🚀 Starting Application")
+    print("=" * 60 + "\n")
+    
+    try:
         with open(app_file) as f:
             exec(f.read(), {'__name__': '__main__'})
-    else:
-        print(f"\n❌ Error: app.py not found in {app_dir}")
+    except Exception as e:
+        print(f"\n❌ Application error: {e}")
+        import traceback
+        traceback.print_exc()
         sys.exit(1)
 
-if __name__ == "__main__":
+
+def main():
+    """Entry point with proper error handling."""
     try:
         setup_and_run()
     except KeyboardInterrupt:
         print("\n\n👋 Application stopped by user")
+        sys.exit(0)
     except Exception as e:
-        print(f"\n❌ Error: {e}")
+        print(f"\n❌ Fatal error: {e}")
         import traceback
         traceback.print_exc()
-        sys.exit(1)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()