Fix env vars substitution from env yaml file (#3981)

libmamba/include/mamba/core/util.hpp

@@ -29,6 +29,12 @@ namespace mamba
     const std::regex& token_regex();
     const std::regex& http_basicauth_regex();
 
+    /**
+     * Expand environment variables present in `s`
+     * if matching R"(\$(\{\w+\}|\w+))" regex.
+     */
+    std::string expandvars(std::string s);
+
     // Used when we want a callback which does nothing.
     struct no_op
     {

libmamba/src/api/configuration.cpp

@@ -378,42 +378,6 @@ namespace mamba
      * hooks *
      *********/
 
-    static std::string expandvars(std::string s)
-    {
-        if (s.find("$") == std::string::npos)
-        {
-            // Bail out early
-            return s;
-        }
-        std::regex env_var_re(R"(\$(\{\w+\}|\w+))");
-        for (auto matches = std::sregex_iterator(s.begin(), s.end(), env_var_re);
-             matches != std::sregex_iterator();
-             ++matches)
-        {
-            std::smatch match = *matches;
-            auto var = match[0].str();
-            if (mamba::util::starts_with(var, "${"))
-            {
-                // strip ${ and }
-                var = var.substr(2, var.size() - 3);
-            }
-            else
-            {
-                // strip $
-                var = var.substr(1);
-            }
-            auto val = util::get_env(var);
-            if (val)
-            {
-                s.replace(match[0].first, match[0].second, val.value());
-                // It turns out to be unsafe to modify the string during
-                // sregex_iterator iteration. Start a new search by recursing.
-                return expandvars(s);
-            }
-        }
-        return s;
-    }
-
     namespace detail
     {
         void ssl_verify_hook(Configuration& config, std::string& value)

libmamba/src/api/install.cpp

@@ -1013,7 +1013,9 @@ namespace mamba
                         }
                         for (auto& c : parse_result.channels)
                         {
-                            updated_channels.push_back(c);
+                            // Substitute env vars in channels from env yaml file,
+                            // before pushing them to the global list of channels
+                            updated_channels.push_back(expandvars(c));
                         }
                         channels.set_cli_value(updated_channels);
                     }

libmamba/src/core/util.cpp

@@ -86,6 +86,42 @@ namespace mamba
         return http_basicauth_regex;
     }
 
+    std::string expandvars(std::string s)
+    {
+        if (s.find("$") == std::string::npos)
+        {
+            // Bail out early
+            return s;
+        }
+        std::regex env_var_re(R"(\$(\{\w+\}|\w+))");
+        for (auto matches = std::sregex_iterator(s.begin(), s.end(), env_var_re);
+             matches != std::sregex_iterator();
+             ++matches)
+        {
+            std::smatch match = *matches;
+            auto var = match[0].str();
+            if (util::starts_with(var, "${"))
+            {
+                // strip ${ and }
+                var = var.substr(2, var.size() - 3);
+            }
+            else
+            {
+                // strip $
+                var = var.substr(1);
+            }
+            auto val = util::get_env(var);
+            if (val)
+            {
+                s.replace(match[0].first, match[0].second, val.value());
+                // It turns out to be unsafe to modify the string during
+                // sregex_iterator iteration. Start a new search by recursing.
+                return expandvars(s);
+            }
+        }
+        return s;
+    }
+
     bool must_persist_temporary_files()
     {
         return persist_temporary_files;

libmamba/tests/src/core/test_configuration.cpp

@@ -88,6 +88,21 @@ namespace mamba
                 config.load();
             }
 
+            void load_file_specs_config(std::string file_specs)
+            {
+                const auto unique_location = tempfile_specs_ptr->path();
+                std::ofstream out_file(
+                    unique_location.std_path(),
+                    std::ofstream::out | std::ofstream::trunc
+                );
+                out_file << file_specs;
+                out_file.close();
+
+                config.reset_configurables();
+                config.at("file_specs").set_value<std::vector<std::string>>({ unique_location.string() });
+                config.load();
+            }
+
             std::string shrink_source(std::size_t position)
             {
                 return util::shrink_home(config.valid_sources()[position].string());
@@ -106,6 +121,10 @@ namespace mamba
                 ".yaml"
             );
 
+            std::unique_ptr<TemporaryFile> tempfile_specs_ptr = std::make_unique<TemporaryFile>(
+                "file_specs",
+                ".yaml"
+            );
 
             mamba::Context& ctx = mambatests::context();
             mamba::Configuration config{ ctx };
@@ -291,6 +310,27 @@ namespace mamba
                 );
             }
 
+            TEST_CASE_METHOD(Configuration, "load_file_specs")
+            {
+                std::string file_specs = unindent(R"(
+                    name: env_name
+                    channels:
+                    - https://private.cloud/t/$SOME_PRIVATE_KEY/get/channel
+                    - https://private.cloud/t/${SOME_OTHER_PRIVATE_KEY}/get/channel
+                    - https://private.cloud/t/SOME_TOKEN/get/channel
+                    - conda-forge
+                    dependencies:
+                    - spec1)");
+                util::set_env("SOME_PRIVATE_KEY", "hdfd5256h6degd5");
+                util::set_env("SOME_OTHER_PRIVATE_KEY", "kqf458r1h127de9");
+                load_file_specs_config(file_specs);
+                const auto src = util::shrink_home(tempfile_ptr->path().string());
+                REQUIRE(
+                    config.dump()
+                    == "channels:\n  - https://private.cloud/t/hdfd5256h6degd5/get/channel\n  - https://private.cloud/t/kqf458r1h127de9/get/channel\n  - https://private.cloud/t/SOME_TOKEN/get/channel\n  - conda-forge"
+                );
+            }
+
             TEST_CASE_METHOD(Configuration, "dump")
             {
                 std::string rc1 = unindent(R"(