New token-command option for cabal upload

[LaurentRDC]

This patch addresses #12130 by adding a new option to cabal upload, --token-command.

• Patches conform to the coding conventions.
• Any changes that could be relevant to users have been recorded in the changelog.
  • Is the change significant? If so, remember to add significance: significant in the changelog file.
• The documentation has been updated, if necessary.
• Manual QA notes have been included.
• Tests have been added. (Ask for help if you don’t know how to write them! Ask for an exemption if tests are too complex for too little coverage!)

[ffaf1]

Manual QA notes have been included.

I do not see them.

[LaurentRDC]

You are right, I misread as "Manual QA done". Apologies!

[Copilot]

Pull request overview

Adds support for obtaining a Hackage upload token by executing an external command, addressing the need to avoid storing tokens in plaintext config files (Issue #12130). This integrates with existing cabal upload flag/config handling patterns similar to --password-command.

Changes:

• Add --token-command (-T) option to cabal upload, plumbed through UploadFlags and config merging.
• Execute the configured command during cabal upload to obtain the token.
• Update docs/changelog and extend config-related tests to cover the new option’s presence/serialization.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
doc/cabal-commands.rst	Documents the new --token-command option for cabal upload.
changelog.d/token-command.md	Adds a user-facing changelog entry for the new option.
cabal-testsuite/PackageTests/UserConfig/cabal.test.hs	Extends user-config update tests to include token-command serialization.
cabal-install/tests/IntegrationTests2.hs	Ensures generated config option comments include token-command.
cabal-install/src/Distribution/Client/Setup.hs	Adds uploadTokenCmd flag and CLI parser for --token-command.
cabal-install/src/Distribution/Client/Main.hs	Runs the command to obtain a token and passes it to upload/uploadDoc.
cabal-install/src/Distribution/Client/Config.hs	Ensures uploadTokenCmd is merged in SavedConfig Semigroup instance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ulysses4ever]

Thanks! After quick skimming this looks ok except the failing test. In order to update the reference output of the test (the reason it fails currently) you have to build the test suite executable from the cabal-testsuite package and run it with the --accept flag as explained in that package's README.

[LaurentRDC]

Thanks for pointing me to the instructions. I was able to update the expectation.

Self-note: I had to run the following commands:

$ cabal build cabal-install
$ ./dist-newstyle/build/x86_64-linux/ghc-9.12.4/cabal-testsuite-3/build/cabal-tests/cabal-tests \
    --accept \
    --with-cabal=./dist-newstyle/build/x86_64-linux/ghc-9.12.4/cabal-install-3.17.0.0/x/cabal/build/cabal/cabal \
    -j 8

[ulysses4ever]

I'll review formally before the weekend

[ulysses4ever]

Thanks!

It’d be nice if someone could try it out (a cabal binary from this patch should be available from CI). Manual QA notes (see the checklist in the PR template) could make it more probable , even if the notes are trivial in this case.

[Bodigrim]

Self-note: I had to run the following commands:

$ cabal build cabal-install
$ ./dist-newstyle/build/x86_64-linux/ghc-9.12.4/cabal-testsuite-3/build/cabal-tests/cabal-tests \
    --accept \
    --with-cabal=./dist-newstyle/build/x86_64-linux/ghc-9.12.4/cabal-install-3.17.0.0/x/cabal/build/cabal/cabal \
    -j 8

You can do it without hardcoding pathes:

cabal build cabal-install:exe:cabal
cabal run cabal-testsuite:exe:cabal-tests -- --with-cabal=$(cabal list-bin cabal-install:exe:cabal) --accept -j8