noconnorandClaude Opus 5
0426ebc973
git never reads GITEA_KEY on its own. With only `credential.helper store`, auth depended on whatever was typed at a first prompt and cached in ~/.git-credentials: it went stale when the token was rotated in the vault, and a box that never pushed had no credential at all, so pushes failed even with a key exported. Add a credential helper scoped to https://git.nic-oconnor.com that hands git $GITEA_KEY as the password (username from GITEA_USER, else the login name). An empty helper entry first clears the inherited `store` for that host, so a rejected token is never cached and a stale one can't win. Other hosts keep `store`. With GITEA_KEY unset it prints nothing and git prompts as before. Idempotent: re-runs leave one copy. Verified: `git credential fill` returns exactly $GITEA_KEY for the host, other hosts are unaffected, ~/.git-credentials stays absent. A dry-run push still fails, because the key currently in the vault is rejected by Gitea (401 on the API too); that is the token, not this wiring. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
55 lines
2.7 KiB
Bash
Executable File
55 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# git/install.sh — configure git identity + HTTPS credential storage.
|
|
# Idempotent: safe to re-run.
|
|
set -eu
|
|
|
|
say() { printf '%s\n' "$*" >&2; }
|
|
|
|
GIT_NAME="Nic O'Connor"
|
|
GIT_EMAIL="nic.oconnor@gmail.com"
|
|
|
|
git config --global user.name "$GIT_NAME"
|
|
git config --global user.email "$GIT_EMAIL"
|
|
say "git identity: $GIT_NAME <$GIT_EMAIL>"
|
|
|
|
# Auto-prune stale remote-tracking refs on every fetch/pull.
|
|
#
|
|
# Without this, `git branch -r` keeps listing branches that were deleted on the
|
|
# server, and zsh's git completion happily offers them — so you tab-complete a
|
|
# branch name into `git push origin --delete` and get "remote ref does not
|
|
# exist" for something that was already gone. The prefix makes it worse: the
|
|
# completion offers `origin/foo`, but the ref on the server is just `foo`, so
|
|
# even a live branch fails unless you strip it by hand. See the `gbd` helper in
|
|
# zsh/zshrc (the grmb helper) for that half.
|
|
git config --global fetch.prune true
|
|
say "fetch.prune = true (stale remote-tracking refs cleaned on every fetch)"
|
|
|
|
# Plaintext credential cache in $HOME (survives container/VM rebuilds that
|
|
# wipe everything outside $HOME). Git creates ~/.git-credentials with 0600
|
|
# the first time a credential is saved.
|
|
git config --global credential.helper store
|
|
say "credential.helper = store (~/.git-credentials, created on first auth)"
|
|
|
|
# Our own Gitea authenticates from $GITEA_KEY (exported by secrets/ from the
|
|
# vault), not from ~/.git-credentials.
|
|
#
|
|
# WHY: git never reads GITEA_KEY by itself. With only `store`, the token was
|
|
# whatever got typed at the first prompt, copied into ~/.git-credentials, and
|
|
# it silently went stale when the vault's key was rotated — or, on a box that
|
|
# never pushed, there was no credential at all and the push just failed. Now
|
|
# `opc GITEA_KEY` is the only step when the token changes.
|
|
#
|
|
# The empty helper first clears the inherited `store` for this host, so a
|
|
# rejected token is never cached and a stale cached one can never win. Gitea
|
|
# accepts the token as the password; the username is informational (GITEA_USER
|
|
# overrides it). With GITEA_KEY unset the helper prints nothing and git falls
|
|
# back to prompting, as before.
|
|
GITEA_URL="https://git.nic-oconnor.com"
|
|
git config --global --unset-all "credential.$GITEA_URL.helper" 2>/dev/null || true
|
|
git config --global --add "credential.$GITEA_URL.helper" ''
|
|
git config --global --add "credential.$GITEA_URL.helper" \
|
|
'!f() { test "$1" = get && test -n "${GITEA_KEY:-}" && printf "username=%s\npassword=%s\n" "${GITEA_USER:-$(id -un)}" "$GITEA_KEY"; }; f'
|
|
say "credential helper for $GITEA_URL = \$GITEA_KEY (from secrets.env)"
|
|
|
|
say "Done. $GITEA_URL uses \$GITEA_KEY; other HTTPS hosts prompt once and cache in ~/.git-credentials."
|