security: harden contribute.py with token validation, error sanitization, and retry/backoff (fixes #288)

[GaneshPatil7517]

Hey pradeeban,

Fixes #288.

This PR improves the security and reliability of contribute.py, mainly around how it handles GitHub API authentication and errors.

Previously the script would continue running even if the token was empty, which could lead to confusing failures later. Now the script checks for CONCORE_BOT_TOKEN at startup and exits with a clear error message if it is missing.

A simple format check is also added for the token using regex. It supports common GitHub token formats such as ghp_, github_pat_, ghs_, and the classic 40-character hex tokens. This helps catch obvious configuration mistakes early.

Some changes were also made to avoid accidental token exposure. Unsafe prints were removed and exception handling avoids logging the token value.

Other fixes and improvements:

• Corrected PR URL construction (pull/{pr.number} instead of pulls/{pr.number})
• Added a small retry wrapper (with_retry) with exponential backoff for GitHub API calls to handle rate limits and temporary server errors
• Replaced incorrect requests.exceptions.* handling with github.GithubException, which is what PyGithub actually raises
• Fixed use of e.response.status_code to the correct e.status attribute
• Removed unused decode_token() function
• Removed unused requests import
• Fixed a few spelling mistakes in messages

These changes are limited to a single file: contribute.py.
No other modules were modified, and existing workflows should continue to work as before.

Testing done locally:

• Script exits with code 1 when CONCORE_BOT_TOKEN is missing
• Script exits with code 1 when token format is invalid
• Classic 40-character tokens pass validation
• github.GithubException is caught correctly (e.g., 401)
• Token values never appear in console output
• PR URLs now use the correct /pull/ endpoint

[Copilot]

Pull request overview

This PR attempts to harden contribute.py by adding token validation, improving error handling, and adding retry logic for GitHub API interactions. The changes address security concerns raised in issue #288 including empty token validation, token format checking, PR URL corrections, and removing unused code.

Changes:

• Added early validation for missing or malformed GitHub tokens (lines 10-18)
• Introduced a github_request() wrapper function with retry/backoff logic (lines 38-55)
• Replaced generic exception handlers with specific requests.exceptions types throughout the file
• Fixed PR URL construction from pulls/{pr.number} to pull/{pr.number} (line 59)
• Removed unused decode_token() function (line 140)
• Added requests and re module imports

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pradeeban]

Can you remove the "Fix 1" "Fix 2" "Fix 3" ... counters please?
Just noting, "Fail fast if token is missing" is sufficient.

The counter of errors indeed help with reviewing the PR. But it shouldn't live in the code itself.

[GaneshPatil7517]

ok @pradeeban sir ill start working on it immediately....

[GaneshPatil7517]

Thank you for the feedback, @pradeeban Sir You're absolutely right the "Fix 1:", "Fix 2:", etc. counters were meant for PR traceability but don't belong in the code itself.
I've removed all the counter prefixes and kept only the descriptive comments (e.g., # Fail fast if token is missing). Changes pushed in commit 08bd61b.
Please let me know if there's anything else to address.