vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-forge: stop embedding the forge token in clone URLs

Browse source
This commit is contained in:
damocles 2026-08-26 00:20:58 +02:00
commit 676f7715fd
6 changed files with 154 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/tools/forge.md
View file

@ -144,7 +144,7 @@ lets a read-only user open a PR by pushing the current `HEAD` to the
magic ref `refs/for/<base>/<topic>`. Two verbs cover the workflow:
```
hive-forge -r internal/knowledge clone # clone with token auto-injected
hive-forge -r internal/knowledge clone # clone, auth handled for you
cd knowledge
# add / edit / delete any files, then commit normally
git add -A && git commit -m "add foo runbook"
@ -155,9 +155,13 @@ hive-forge -r internal/knowledge pr-create --agit \
```
`clone` derives the dest dir from the repo basename (override with a
positional arg); `--branch` / `--depth` are passed through. The token
is injected into the clone's `origin` remote so `pr-create --agit`
(default remote `origin`) can push without re-auth.
positional arg); `--branch` / `--depth` are passed through. The clone
URL and the `origin` remote it leaves behind carry no credentials —
`clone` instead configures `origin`'s `credential.helper` to invoke
`hive-forge credential-helper` (a hidden verb, not meant to be run by
hand), which git calls fresh on every fetch/push. That's what lets
`pr-create --agit` (default remote `origin`) push without re-auth,
without a durable token sitting in the checkout's `.git/config`.
`pr-create --agit` prints the PR URL. Re-running with the same
`--topic` force-updates the existing open PR (the AGit ref is