4b472a2242
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
core.filemode=false in this worktree meant the initial commit recorded git-credential-mosaic, test-git-credential-mosaic.sh, and test-gitea-token-identity.sh as 100644. git invokes a path-configured credential.helper directly (exec, not `sh <path>`), so git-credential-mosaic must carry the executable bit; the two test scripts match the 100755 convention already used by the other test-*.sh harnesses in this directory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
70 lines
3.1 KiB
Bash
Executable File
70 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# git-credential-mosaic — git credential helper — resolves Gitea tokens from
|
|
# the Mosaic credential store at runtime so remote URLs never embed secrets.
|
|
#
|
|
# Install (one-time, per clone or globally):
|
|
# git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
|
|
# # or, fleet-wide: git config --global credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
|
|
#
|
|
# Per-agent Gate-16 identity (author != reviewer separation):
|
|
# git config mosaic.gitIdentity <agent-id> # per-worktree, persists on disk
|
|
# # or: export MOSAIC_GIT_IDENTITY=<agent-id>
|
|
#
|
|
# Resolution priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity
|
|
# (per-worktree, survives across non-persistent shells) > git-supplied username
|
|
# (credential.username / URL). When the resolved identity has a matching
|
|
# per-agent token file, use it instead of the shared account. Backward
|
|
# compatible: nothing resolvable -> shared token (unchanged behavior).
|
|
[ "$1" = "get" ] || exit 0
|
|
host=""; username_in=""
|
|
while IFS= read -r line; do
|
|
[ -z "$line" ] && break
|
|
case "$line" in
|
|
host=*) host=${line#host=};;
|
|
username=*) username_in=${line#username=};;
|
|
esac
|
|
done
|
|
# Per-agent identity resolution (Gate-16 author≠reviewer separation).
|
|
# Priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity (per-worktree,
|
|
# survives across non-persistent shells) > git-supplied username (credential.username
|
|
# / URL). When the resolved identity has a matching per-agent token, use it instead of
|
|
# the shared account. Backward-compatible: nothing resolvable → shared token.
|
|
ident="$MOSAIC_GIT_IDENTITY"
|
|
[ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
|
|
[ -z "$ident" ] && ident="$username_in"
|
|
if [ -n "$ident" ]; then
|
|
case "$host" in
|
|
git.uscllc.com) idpfx=gitea-usc;;
|
|
git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
|
|
*) idpfx="";;
|
|
esac
|
|
if [ -n "$idpfx" ]; then
|
|
idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
|
|
if [ -r "$idtok" ]; then
|
|
echo "username=${ident}"
|
|
echo "password=$(cat "$idtok")"
|
|
exit 0
|
|
fi
|
|
fi
|
|
fi
|
|
case "$host" in
|
|
git.uscllc.com) svc=gitea-usc;;
|
|
git.mosaicstack.dev) svc=gitea-mosaicstack;;
|
|
*) exit 0;;
|
|
esac
|
|
# Script-relative (not $HOME-absolute) so this resolves correctly regardless
|
|
# of where the framework installer places tools/ under $HOME — mirrors
|
|
# detect-platform.sh's own cred_loader resolution in this same directory.
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=../_lib/credentials.sh
|
|
source "$script_dir/../_lib/credentials.sh"
|
|
load_credentials "$svc" >/dev/null 2>&1 || exit 0
|
|
# GITEA_USER is not populated by load_credentials (it only exports
|
|
# GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
|
|
# git-over-HTTP auth authenticates from the token itself (the password field),
|
|
# not from the username string, so any non-empty placeholder works here — this
|
|
# is deliberately NOT a real account name (framework files must stay
|
|
# operator-agnostic; see tools/quality/scripts/verify-sanitized.sh).
|
|
echo "username=${GITEA_USER:-git}"
|
|
echo "password=$GITEA_TOKEN"
|