ddev doesn't force writing github uname and token to config file

ddev/changelog.d/22691.fixed

@@ -0,0 +1 @@
+Stop writing the GitHub username and token to the config file. Read them directly from environment variables instead.

ddev/src/ddev/cli/application.py

@@ -94,6 +94,11 @@ def initialize_old_cli(self):
         self.__config['color'] = not self.console.no_color
         self.__config['dd_api_key'] = self.config.orgs.get('default', {}).get('api_key', '')
         self.__config['dd_app_key'] = self.config.orgs.get('default', {}).get('app_key', '')
+        # Ensure GitHub config is available for old CLI commands that need it
+        self.__config['github'] = {
+            'user': self.config.github.user,
+            'token': self.config.github.token,
+        }
         # Make sure that envvar overrides of repo make it into config.
         self.__config['repo'] = self.repo.name
         # Transfer the -x/--here flag to the old CLI.

ddev/src/ddev/config/model.py

@@ -487,7 +487,7 @@ def user(self):
 
                 self._field_user = user
             else:
-                self._field_user = self.raw_data['user'] = get_github_user()
+                self._field_user = get_github_user()
 
         return self._field_user
 
@@ -506,7 +506,7 @@ def token(self):
 
                 self._field_token = token
             else:
-                self._field_token = self.raw_data['token'] = get_github_token()
+                self._field_token = get_github_token()
 
         return self._field_token
 

ddev/tests/config/test_model.py

@@ -35,10 +35,7 @@ def test_default():
                 'log_url': os.getenv('DD_LOGS_CONFIG_LOGS_DD_URL', ''),
             },
         },
-        'github': {
-            'user': get_github_user(),
-            'token': get_github_token(),
-        },
+        'github': {},
         'pypi': {
             'user': '',
             'auth': '',
@@ -714,10 +711,7 @@ def test_default(self):
         assert config.github.user == config.github.user == get_github_user()
         assert config.github.token == config.github.token == get_github_token()
         assert config.raw_data == {
-            'github': {
-                'user': get_github_user(),
-                'token': get_github_token(),
-            },
+            'github': {},
         }
 
     def test_not_table(self, helpers):
@@ -1409,3 +1403,74 @@ def test_styles_spinner_set_lazy_error(self, helpers):
             ),
         ):
             _ = config.terminal.styles.spinner
+
+
+class TestGitHubConfig:
+    def test_default_github_config_empty_raw_data(self):
+        config = RootConfig({})
+        config.parse_fields()
+
+        # GitHub config should be empty in raw_data when not explicitly set
+        assert config.raw_data['github'] == {}
+
+        # But properties should still work via environment variables
+        assert config.github.user == get_github_user()
+        assert config.github.token == get_github_token()
+
+        # After accessing properties, raw_data should still be empty
+        assert config.raw_data['github'] == {}
+
+    def test_explicit_github_config_in_raw_data(self):
+        config = RootConfig({'github': {'user': 'explicit_user', 'token': 'explicit_token'}})
+
+        # When explicitly set, values should be in raw_data
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+        # Properties should return explicit values
+        assert config.github.user == 'explicit_user'
+        assert config.github.token == 'explicit_token'
+
+    def test_partial_github_config_explicit_user_only(self):
+        config = RootConfig({'github': {'user': 'explicit_user'}})
+
+        # Only explicitly set field should be in raw_data
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert 'token' not in config.raw_data['github']
+
+        # Properties should work - explicit user, env var token
+        assert config.github.user == 'explicit_user'
+        assert config.github.token == get_github_token()
+
+        # raw_data should still only have explicit field
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert 'token' not in config.raw_data['github']
+
+    def test_partial_github_config_explicit_token_only(self):
+        config = RootConfig({'github': {'token': 'explicit_token'}})
+
+        # Only explicitly set field should be in raw_data
+        assert 'user' not in config.raw_data['github']
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+        # Properties should work - env var user, explicit token
+        assert config.github.user == get_github_user()
+        assert config.github.token == 'explicit_token'
+
+        # raw_data should still only have explicit field
+        assert 'user' not in config.raw_data['github']
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+    def test_github_config_with_environment_variables(self, monkeypatch):
+        # Mock environment variables
+        monkeypatch.setenv('DD_GITHUB_USER', 'env_user')
+        monkeypatch.setenv('DD_GITHUB_TOKEN', 'env_token')
+
+        config = RootConfig({})
+
+        # Properties should return environment variable values
+        assert config.github.user == 'env_user'
+        assert config.github.token == 'env_token'
+
+        # raw_data should still be empty
+        assert config.raw_data['github'] == {}