vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-forge: stop embedding the forge token in clone URLs

Browse source
This commit is contained in:
damocles 2026-08-26 00:20:58 +02:00
commit 676f7715fd
6 changed files with 154 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

21
hive-forge/src/verbs/clone.rs
View file

@ -4,6 +4,15 @@
//! `client::Client::from_env` for the full resolution chain). Pairs
//! with `pr-create --agit`: clone, edit + commit normally, then open a
//! PR via the `AGit` ref.
//!
//! The clone URL itself carries no credentials, and the resulting
//! checkout's `.git/config` never gets one either: `-c
//! credential.helper=!hive-forge credential-helper` (baked into the
//! `git clone` invocation, which persists into the new repo's config)
//! makes git ask the `credential-helper` verb for a fresh token on every
//! subsequent fetch/push instead. Previously the token itself rode in
//! the clone URL and landed, durably, in every checkout's `.git/config` —
//! a real credential leaked to every clone on disk, reported by atlas.
use std::process::Command;
@ -40,9 +49,17 @@ pub fn run(client: &Client, args: Args) -> Result<()> {
.map(str::to_owned)
.with_context(|| format!("clone: cannot derive a destination dir from repo {repo}"))?,
};
let url = client.authed_git_url(repo);
let url = client.plain_git_url(repo);
let helper = match client.forge_label() {
Some(label) => format!("!hive-forge credential-helper -f {label}"),
None => "!hive-forge credential-helper".to_owned(),
};
let mut git_args = vec!["clone".to_owned()];
let mut git_args = vec![
"clone".to_owned(),
"-c".to_owned(),
format!("credential.helper={helper}"),
];
if let Some(depth) = args.depth {
git_args.push(format!("--depth={depth}"));
}