Update entrypoint.sh

entrypoint.sh

@@ -1,26 +1,25 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# ---- config
 : "${GITHUB_REPO_URL:=https://github.com/chourmovs/RFPmaster.git}"
-: "${GITHUB_TOKEN:=}"                # <- set this in HF Space “Repository secrets”
-: "${API_MODULE:=rfp_api}"           # module exposing `app = FastAPI(...)` in the repo
-: "${API_APP_ATTR:=app}"             # attribute name
-: "${WORKSPACE:=/workspace}"
+: "${GITHUB_TOKEN:=}"                 # set in Space “Repository secrets”
+: "${API_MODULE:=rfp_api}"            # module exposing `app = FastAPI(...)`
+: "${API_APP_ATTR:=app}"
+: "${WORKSPACE:=/home/user/workspace}"
+
 CLONE_DIR="${WORKSPACE}/RFPmaster"
 
 echo "[startup] WORKSPACE=${WORKSPACE}"
 echo "[startup] target clone dir: ${CLONE_DIR}"
 
-# ---- clone private repo at runtime (now env vars are present)
+# clone repo (private if token provided)
 if [ ! -d "${CLONE_DIR}" ]; then
   echo "[git] Cloning repo…"
   if [ -n "${GITHUB_TOKEN}" ]; then
-    # inject token in URL (read-only)
-    TOKENIZED="${GITHUB_REPO_URL/https:\/\//https:\/\/${GITHUB_TOKEN}@}"
-    git clone --depth=1 "${TOKENIZED}" "${CLONE_DIR}"
+    # Safer: send token via header (avoids putting it in the URL & process list)
+    git -c http.extraHeader="Authorization: Basic $(printf 'oauth2:%s' "${GITHUB_TOKEN}" | base64 -w0)" \
+        clone --depth=1 "${GITHUB_REPO_URL}" "${CLONE_DIR}"
   else
-    echo "[warn] GITHUB_TOKEN is empty; trying to clone public repo URL"
     git clone --depth=1 "${GITHUB_REPO_URL}" "${CLONE_DIR}"
   fi
 else
@@ -29,25 +28,17 @@ else
   git -C "${CLONE_DIR}" reset --hard origin/HEAD || true
 fi
 
-# allow git-safe checks if needed
 git config --global --add safe.directory "${CLONE_DIR}" || true
 
-# ---- Python deps
 echo "[pip] Installing requirements (if any)…"
 if [ -f "${CLONE_DIR}/requirements.txt" ]; then
   pip install -r "${CLONE_DIR}/requirements.txt"
 else
-  echo "[pip] No requirements.txt found — installing API basics."
   pip install fastapi uvicorn requests
 fi
 
-# Optional: your API code may import local packages; make sure Python can find them
 export PYTHONPATH="${CLONE_DIR}:${PYTHONPATH:-}"
-
-# ---- run uvicorn from inside the repo so relative imports work
 cd "${CLONE_DIR}"
 
-# If your repo’s API file expects certain env (e.g., DEEPINFRA_API_KEY), set them in HF Secrets
 echo "[uvicorn] launching ${API_MODULE}:${API_APP_ATTR} on 0.0.0.0:7860"
 exec uvicorn "${API_MODULE}:${API_APP_ATTR}" --host 0.0.0.0 --port 7860
-