# FinanceManager GitHub token push from Drive

Use when FinanceManager has a local commit that must be pushed and the valid GitHub token is stored in Google Drive as `Github_token_FinanceManager`.

## Safety rules

- Do not print the token or write it into repo files, docs, tests, fixtures, reports, logs, or `.env.example`.
- Store any downloaded token file only outside the repo, preferably under `~/jarvis_runtime/finance-system/secrets/` with `chmod 700` on the directory and `chmod 600` on the file.
- Do not `git remote set-url` to a token-bearing URL. Use a temporary environment variable or local shell variable for one command only.
- Never force-push. If remote has advanced, stop and report before merge/rebase.

## Retrieval pattern

```bash
mkdir -p ~/jarvis_runtime/finance-system/secrets
chmod 700 ~/jarvis_runtime/finance-system/secrets

# Search Drive without printing file contents.
GOG_KEYRING_PASSWORD='...' gog -a friday.uplink@gmail.com \
  drive search "Github_token_FinanceManager" --max 10 --json --results-only

# Download the Google Sheet as CSV to the runtime secrets dir.
GOG_KEYRING_PASSWORD='...' gog -a friday.uplink@gmail.com \
  drive download <file_id> --format=csv \
  --out="$HOME/jarvis_runtime/finance-system/secrets/Github_token_FinanceManager.csv" \
  --json >/tmp/gdrive_token_download.json
chmod 600 "$HOME/jarvis_runtime/finance-system/secrets/Github_token_FinanceManager.csv"
rm -f /tmp/gdrive_token_download.json
```

Do not echo the CSV. Parse the repo URL and token inside a script and redact on errors.

## Pre-push gate

Run before pushing:

```bash
PYTHONPATH=src python -m compileall src tests
PYTHONPATH=src pytest tests -q
find . -type d \( -name __pycache__ -o -name .pytest_cache \) -prune -exec rm -rf {} +
PYTHONPATH=src python -m jarvis_finance.cli.main git-safety-scan .
git status --short --branch
```

Expected for the pending-push case: clean worktree and `main...origin/main [ahead 1]` or equivalent.

## Non-force push pattern

Use a temporary authenticated URL without changing the remote:

```bash
TOKEN=$(python - <<'PY'
import re
from pathlib import Path
text = Path.home().joinpath('jarvis_runtime/finance-system/secrets/Github_token_FinanceManager.csv').read_text()
print(re.search(r'github_pat_[A-Za-z0-9_]+|ghp_[A-Za-z0-9_]+|gho_[A-Za-z0-9_]+', text).group(0))
PY
)
AUTH_URL="https://${TOKEN}@github.com/Gamexgit/FinanceManager.git"

git fetch "$AUTH_URL" main:refs/remotes/origin/main --quiet
LOCAL=$(git rev-parse HEAD)
ORIGIN=$(git rev-parse origin/main)
BASE=$(git merge-base HEAD origin/main)

if [ "$ORIGIN" != "$BASE" ]; then
  unset TOKEN AUTH_URL
  echo 'REMOTE_HAS_NEW_COMMITS=yes'
  exit 3
fi

git push "$AUTH_URL" main:main
unset TOKEN AUTH_URL
```

Then verify:

```bash
git fetch <temporary-auth-url> main:refs/remotes/origin/main --quiet
PYTHONPATH=src python -m jarvis_finance.cli.main git-safety-scan .
git status --short --branch
git rev-parse --short HEAD
git rev-parse --short origin/main
```

## Reporting

Report only:

- push success yes/no
- remote HEAD short SHA
- commit hash
- tests result
- Git-safety result
- git status
- open risks

Never report the token or token-bearing URL.