chore(deps): Bump sentry-scm to 2.0.0

pyproject.toml

@@ -100,7 +100,7 @@ dependencies = [
   "sentry-redis-tools>=0.5.0",
   "sentry-viewercontext>=0.1.0",
   "sentry-relay>=0.10.1",
-  "sentry-scm>=1.9.0",
+  "sentry-scm>=2.0.0",
   "sentry-sdk[http2]>=2.72.0",
   "sentry-usage-accountant>=0.0.10",
   "simplejson>=3.17.6",

src/sentry/scm/endpoints/scm_rpc.py

@@ -1,6 +1,7 @@
 from django.conf import settings
 from django.http import HttpResponse, StreamingHttpResponse
 from rest_framework.request import Request
+from scm import Secret
 from scm.rpc.server import RpcServer
 from sentry_sdk import traces
 
@@ -13,7 +14,7 @@
 def make_server():
     fetchers = make_fetchers()
     return RpcServer(
-        secrets=settings.SCM_RPC_SHARED_SECRET or [],
+        secrets=[Secret(secret) for secret in settings.SCM_RPC_SHARED_SECRET or []],
         fetch_repository=fetchers.fetch_repository,
         fetch_provider=fetchers.fetch_provider,
         record_count=record_count_metric,

tests/sentry/scm/endpoints/test_scm_rpc.py

@@ -6,6 +6,7 @@
 import responses
 from django.test import override_settings
 from django.urls import reverse
+from scm import Secret
 from scm.actions import create_branch
 from scm.manager import SourceCodeManager
 from scm.rpc.helpers import sign_get, sign_post
@@ -56,7 +57,8 @@ def _convert(self, django_response):
     def get(self, url, headers=None):
         return self._convert(self._client.get(url, headers=headers))
 
-    def post(self, url, data=None, headers=None):
+    def post(self, url, data=None, headers=None, stream=False):
+        # `stream` is accepted to match the Session protocol; _convert reads the whole body either way.
         h = dict(headers) if headers else {}
         content_type = h.pop("Content-Type", "application/octet-stream")
         return self._convert(
@@ -89,11 +91,11 @@ def setUp(self) -> None:
                 self.organization.id,
                 self.repo.id,
                 base_url="",
-                signing_secret="a-long-value-that-is-hard-to-guess",
+                signing_secret=Secret("a-long-value-that-is-hard-to-guess"),
             )
 
         self.default_headers = {
-            "Authorization": f"rpcsignature {sign_get('a-long-value-that-is-hard-to-guess', self.organization.id, self.repo.id)}",
+            "Authorization": f"rpcsignature {sign_get(Secret('a-long-value-that-is-hard-to-guess'), self.organization.id, self.repo.id)}",
             "X-Organization-Id": str(self.organization.id),
             "X-Repository-Id": str(self.repo.id),
         }
@@ -136,7 +138,7 @@ def test_get_fetches_the_integration_once_per_request(self):
             integration_id=integration.id,
         )
         headers = {
-            "Authorization": f"rpcsignature {sign_get('a-long-value-that-is-hard-to-guess', self.organization.id, repo.id)}",
+            "Authorization": f"rpcsignature {sign_get(Secret('a-long-value-that-is-hard-to-guess'), self.organization.id, repo.id)}",
             "X-Organization-Id": str(self.organization.id),
             "X-Repository-Id": str(repo.id),
         }
@@ -169,7 +171,7 @@ def test_get_missing_auth(self):
 
     def test_get_invalid_secret(self):
         def sig(secret):
-            return f"rpcsignature {sign_get(secret, self.organization.id, self.repo.id)}"
+            return f"rpcsignature {sign_get(Secret(secret), self.organization.id, self.repo.id)}"
 
         # Succeeds with correct secret.
         headers = {
@@ -201,7 +203,7 @@ def test_post_invalid_secret(self):
                 data=b"test",
                 headers={
                     **self.default_headers,
-                    "Authorization": f"rpcsignature {sign_post('s', b'test')}",
+                    "Authorization": f"rpcsignature {sign_post(Secret('s'), b'test')}",
                 },
             ),
             401,