Shim command before python call

[jamesstidard]

1Password have a way of storing secrets securely in your .env, and I was looking to see if I could fit it into my workflow.

It relies on an activating a shell environment which handles authentication, and then replacing those environment variables at run time. And as a bonus, it conceals those secrets if they are ever printed to stdout/err.

Here's how you might run a pipenv project:

# .env
PYTHONPATH=.
SECRET=op://development/service/password

# main.py
import os

print("SECRET", os.environ["SECRET"])

$ pipenv run op run -- python main.py
Loading .env environment variables...
SECRET <concealed by 1Password>

I was wondering if there's any way to shim the op run -- segment in before any calls that vscode makes to python?

[brettcannon]

It depends on what you want it for. You can use a custom task to launch using op. If you're specifically asking about debugging and the Run button then there's https://code.visualstudio.com/docs/python/debugging#_set-configuration-options where you should be able to specify the right settings, probably by lying that op is Python and then specifying pythonArgs.

[jamesstidard]

@brettcannon ah sorry, I was ambitious. Yeah, talking about debugging/running in vscode.

That was a good idea, I didn't think of that. Unfortunately vscode seems too smart and calls me out on the lie.

# .vscode/launch.json
{
    // Use IntelliSense to learn about possible attributes.
    // Hover to view descriptions of existing attributes.
    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Current File",
            "type": "python",
            "request": "launch",
            "program": "${file}",
            "console": "integratedTerminal",
            "python": "/usr/local/bin/op",
            "pythonArgs": ["run", "--", "${command:python.interpreterPath}"]
        },
    ]
}

# Output Panel: Python
[ERROR 2022-4-10 19:28:41.623]: Invalid Python Path '/usr/local/bin/op'

Ran with that idea a bit further and made a shim:

#!/usr/bin/env bash
/usr/local/bin/op run -- .venv/bin/python "$@"

{
    // Use IntelliSense to learn about possible attributes.
    // Hover to view descriptions of existing attributes.
    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Current File",
            "type": "python",
            "request": "launch",
            "program": "${file}",
            "console": "integratedTerminal",
            "python": "${workspaceFolder}/python-shim"
        },
    ]
}

My thinking was maybe vscode would calling op at certain points without the pythonArgs and was able to see it wasn't python, but it also knows the shim is a lie, even though I believe it would behave like any python binary (as far as I know).

[brettcannon]

We are probably doing some sanity checks on the value of python. Feel free to open a feature request if you would like us to consider dropping the check.

[jamesstidard]

I will do, appreciate your time. Have a nice morning/afternoon/evening.