ARROW-16708: [Dev] Replace basic auth with token auth for JIRA (apach…

…e#13283)

Authored-by: Jacob Wujciak-Jens <[email protected]>
Signed-off-by: Sutou Kouhei <[email protected]>

dev/README.md

@@ -54,12 +54,15 @@ have to install Python dependencies yourself and then run `dev/merge_arrow_pr.py
 directly)
 
 The merge script uses the GitHub REST API. You must set a
-`ARROW_GITHUB_API_TOKEN` environment variable to use a Personal Access
-Token. You need to add `workflow` scope to the Personal Access Token.
-
-You can specify the username and the password of your JIRA account in
-`APACHE_JIRA_USERNAME` and `APACHE_JIRA_PASSWORD` environment variables.
-If these aren't supplied, the script will ask you the values of them.
+`ARROW_GITHUB_API_TOKEN` environment variable to use a 
+[Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). 
+You need to add `workflow` scope to the Personal Access Token.
+
+You can specify the 
+[Personal Access Token](https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html)
+of your JIRA account in the 
+`APACHE_JIRA_TOKEN` environment variable.
+If the variable is not set, the script will ask you for it.
 
 Note that the directory name of your Arrow git clone must be called `arrow`.
 

dev/archery/archery/release.py

@@ -18,7 +18,6 @@
 from abc import abstractmethod
 from collections import defaultdict
 import functools
-import os
 import re
 import pathlib
 import shelve
@@ -85,11 +84,8 @@ def number(self):
 
 class Jira(JIRA):
 
-    def __init__(self, user=None, password=None,
-                 url='https://issues.apache.org/jira'):
-        user = user or os.environ.get('APACHE_JIRA_USER')
-        password = password or os.environ.get('APACHE_JIRA_PASSWORD')
-        super().__init__(url, basic_auth=(user, password))
+    def __init__(self, url='https://issues.apache.org/jira'):
+        super().__init__(url)
 
     def project_version(self, version_string, project='ARROW'):
         # query version from jira to populated with additional metadata

dev/merge.conf.sample

@@ -19,10 +19,8 @@
 # Install a copy of this file at ~/.config/arrow/merge.conf
 
 [jira]
-# issues.apache.org JIRA credentials. Sadly, the jira instance doesn't offer
-# token credentials. Ensure that the file is properly protected.
-username=johnsmith
-password=123456
+# issues.apache.org Jira personal access token
+token=abc123
 
 [github]
 # GitHub's personal access token. "workflow" scope is needed.

dev/merge_arrow_pr.py

@@ -31,8 +31,7 @@
 # variables.
 #
 # Configuration environment variables:
-#   - APACHE_JIRA_USERNAME: your Apache JIRA ID
-#   - APACHE_JIRA_PASSWORD: your Apache JIRA password
+#   - APACHE_JIRA_TOKEN: your Apache JIRA Personal Access Token
 #   - ARROW_GITHUB_API_TOKEN: a GitHub API token to use for API requests
 #   - PR_REMOTE_NAME: the name of the remote to the Apache git repo (set to
 #                     'apache' by default)
@@ -492,47 +491,28 @@ def load_configuration():
 
 
 def get_credentials(cmd):
-    username, password = None, None
+    token = None
 
     config = load_configuration()
     if "jira" in config.sections():
-        username = config["jira"].get("username")
-        password = config["jira"].get("password")
+        token = config["jira"].get("token")
 
     # Fallback to environment variables
-    if not username:
-        username = os.environ.get("APACHE_JIRA_USERNAME")
-
-    if not password:
-        password = os.environ.get("APACHE_JIRA_PASSWORD")
+    if not token:
+        token = os.environ.get("APACHE_JIRA_TOKEN")
 
     # Fallback to user tty prompt
-    if not username:
-        username = cmd.prompt("Env APACHE_JIRA_USERNAME not set, "
-                              "please enter your JIRA username:")
-
-    if not password:
-        password = cmd.getpass("Env APACHE_JIRA_PASSWORD not set, "
-                               "please enter your JIRA password:")
+    if not token:
+        token = cmd.prompt("Env APACHE_JIRA_TOKEN not set, "
+                           "please enter your Jira API token "
+                           "(Jira personal access token):")
 
-    return (username, password)
+    return token
 
 
 def connect_jira(cmd):
-    try:
-        return jira.client.JIRA(options={'server': JIRA_API_BASE},
-                                basic_auth=get_credentials(cmd))
-    except jira.exceptions.JIRAError as e:
-        if "CAPTCHA_CHALLENGE" in e.text:
-            print("")
-            print("It looks like you need to answer a captcha challenge for "
-                  "this account (probably due to a login attempt with an "
-                  "incorrect password). Please log in at "
-                  "https://issues.apache.org/jira and complete the captcha "
-                  "before running this tool again.")
-            print("Exiting.")
-            sys.exit(1)
-        raise e
+    return jira.client.JIRA(options={'server': JIRA_API_BASE},
+                            token_auth=get_credentials(cmd))
 
 
 def get_pr_num():