Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 64 additions & 1 deletion eval_protocol/auth.py
Original file line number Diff line number Diff line change
@@ -1,12 +1,75 @@
import logging
import os
from typing import Optional
from typing import Dict, Optional

import requests
from dotenv import dotenv_values, find_dotenv, load_dotenv

logger = logging.getLogger(__name__)


def find_dotenv_path(search_path: Optional[str] = None) -> Optional[str]:
"""
Find the .env file path, searching .env.dev first, then .env.

Args:
search_path: Directory to search from. If None, uses current working directory.

Returns:
Path to the .env file if found, otherwise None.
"""
# If a specific search path is provided, look there first
if search_path:
env_dev_path = os.path.join(search_path, ".env.dev")
if os.path.isfile(env_dev_path):
return env_dev_path
env_path = os.path.join(search_path, ".env")
if os.path.isfile(env_path):
return env_path
return None

# Otherwise use find_dotenv to search up the directory tree
env_dev_path = find_dotenv(filename=".env.dev", raise_error_if_not_found=False, usecwd=True)
if env_dev_path:
return env_dev_path
env_path = find_dotenv(filename=".env", raise_error_if_not_found=False, usecwd=True)
if env_path:
return env_path
return None
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent dotenv search behavior between host and Docker

Medium Severity

The find_dotenv_path function behaves differently depending on whether search_path is provided. Without an argument, it searches up the directory tree using find_dotenv(). With a path, it only looks in that exact directory. The module-level load uses the former (finding parent .env files), while get_dotenv_values(project_root) uses the latter. This means environment variables from a parent directory's .env file are loaded into the host but not forwarded to Docker, causing tests to pass locally but fail in the container.

Additional Locations (1)

Fix in Cursor Fix in Web



def get_dotenv_values(search_path: Optional[str] = None) -> Dict[str, Optional[str]]:
"""
Get all key-value pairs from the .env file.

Args:
search_path: Directory to search from. If None, uses current working directory.

Returns:
Dictionary of environment variable names to values.
"""
dotenv_path = find_dotenv_path(search_path)
if dotenv_path:
return dotenv_values(dotenv_path)
return {}


# --- Load .env files ---
# Attempt to load .env.dev first, then .env as a fallback.
# This happens when the module is imported.
# We use override=False (default) so that existing environment variables
# (e.g., set in the shell) are NOT overridden by .env files.
_DOTENV_PATH = find_dotenv_path()
if _DOTENV_PATH:
load_dotenv(dotenv_path=_DOTENV_PATH, override=False)
logger.debug(f"eval_protocol.auth: Loaded environment variables from: {_DOTENV_PATH}")
else:
logger.debug(
"eval_protocol.auth: No .env.dev or .env file found. Relying on shell/existing environment variables."
)
# --- End .env loading ---


def get_fireworks_api_key() -> Optional[str]:
"""
Retrieves the Fireworks API key.
Expand Down
7 changes: 7 additions & 0 deletions eval_protocol/cli_commands/local_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import sys
from typing import List

from ..auth import get_dotenv_values
from .utils import _build_entry_point, _discover_and_select_tests


Expand Down Expand Up @@ -71,6 +72,12 @@ def _run_pytest_in_docker(
workdir,
]

# Forward environment variables from .env file to the container
dotenv_vars = get_dotenv_values(project_root)
for key, value in dotenv_vars.items():
if value is not None:
cmd += ["-e", f"{key}={value}"]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dotenv variables may override critical container settings

Medium Severity

Environment variables from the .env file are added after the hardcoded HOME and EVAL_PROTOCOL_DIR settings. In Docker, when the same -e flag is specified multiple times, the last value wins. If a user's .env file contains HOME or EVAL_PROTOCOL_DIR, these values would override the container's critical configuration (HOME=/container_home, EVAL_PROTOCOL_DIR=/container_home/.eval_protocol), potentially breaking the container's ability to write logs and artifacts to the mounted volume.

Fix in Cursor Fix in Web


# If EP_SUMMARY_JSON is set on the host, mirror it into the container so that
# pytest evaluation tests can write summary artifacts that are visible to the
# host. We map paths under the host logs directory (~/.eval_protocol) into the
Expand Down
Loading