Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_git.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import pytest
 
 from nisse_dev.execution import SSHHost
-from nisse_dev.git import GitError, GitRepo
+from nisse_dev.git import GitError, GitRepo, HTTPSToken, SSHKey
 
 
 @pytest.fixture
@@ -76,16 +76,16 @@ def test_commits_since_and_remote_sha_against_a_local_remote(
 
 
 @pytest.fixture
-def ssh_remote(ssh_host: SSHHost, tmp_path: Path) -> tuple[str, str]:
+def ssh_remote(ssh_host: SSHHost, tmp_path: Path) -> tuple[str, SSHKey]:
     """A bare repository reached by git over SSH, and the key that may push
     to it: the forge, as the build VM sees it."""
     remote = bare_remote(tmp_path / "forge.git")
     url = f"ssh://{ssh_host.user}@127.0.0.1:{ssh_host.port}{remote}"
-    return url, ssh_host._key.read_text()
+    return url, SSHKey(ssh_host._key.read_text())
 
 
 def test_clone_and_push_with_the_key_store_no_credential(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     url, key = ssh_remote
     seed = GitRepo(ssh_host, tmp_path / "seed", known_hosts=str(tmp_path / "kh"))
@@ -93,10 +93,10 @@ def test_clone_and_push_with_the_key_store_no_credential(
     seed.configure_identity("t", "t@example.test")
     (seed.root / "a.txt").write_text("a")
     seed.commit_all("first")
-    seed.push(url, "main", key=key)
+    seed.push(url, "main", credential=key)
 
     clone = GitRepo(ssh_host, tmp_path / "clone", known_hosts=str(tmp_path / "kh"))
-    clone.clone(url, key=key)
+    clone.clone(url, credential=key)
     assert (clone.root / "a.txt").read_text() == "a"
     config = (clone.root / ".git" / "config").read_text()
     assert "PRIVATE KEY" not in config
@@ -105,7 +105,7 @@ def test_clone_and_push_with_the_key_store_no_credential(
 
 
 def test_the_key_is_gone_when_the_command_ends(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     url, key = ssh_remote
     repo = GitRepo(ssh_host, tmp_path / "w", known_hosts=str(tmp_path / "kh"))
@@ -114,12 +114,12 @@ def test_the_key_is_gone_when_the_command_ends(
     (repo.root / "a.txt").write_text("a")
     repo.commit_all("first")
     before = _agents()
-    repo.push(url, "main", key=key)
+    repo.push(url, "main", credential=key)
     assert _agents() == before  # the throwaway ssh-agent was killed
 
 
 def test_a_failed_push_still_kills_its_agent(
-    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, str]
+    ssh_host: SSHHost, tmp_path: Path, ssh_remote: tuple[str, SSHKey]
 ) -> None:
     _, key = ssh_remote
     repo = GitRepo(ssh_host, tmp_path / "w", known_hosts=str(tmp_path / "kh"))
@@ -127,7 +127,9 @@ def test_a_failed_push_still_kills_its_agent(
     before = _agents()
     with pytest.raises(GitError):
         repo.push(
-            f"ssh://nobody@127.0.0.1:{ssh_host.port}/nowhere.git", "main", key=key
+            f"ssh://nobody@127.0.0.1:{ssh_host.port}/nowhere.git",
+            "main",
+            credential=key,
         )
     assert _agents() == before
 
@@ -144,3 +146,52 @@ def test_a_remote_url_is_quoted_not_interpreted(repo: GitRepo, tmp_path: Path) -
     with pytest.raises(GitError):
         repo.push(f"x; touch {shlex.quote(str(marker))}", "main")
     assert not marker.exists()
+
+
+class RecordingHost:
+    """Captures what would be sent to the build VM."""
+
+    def __init__(self) -> None:
+        self.calls: list[dict] = []
+
+    def execute(self, command: str, **kwargs):
+        from nisse_dev.execution import Result
+
+        self.calls.append({"command": command, **kwargs})
+        return Result(0, "", "")
+
+
+def test_an_https_token_travels_only_as_a_secret(tmp_path: Path) -> None:
+    host = RecordingHost()
+    repo = GitRepo(host, tmp_path)  # type: ignore[arg-type]
+    token = "tok-" + "9f3a" * 6
+    repo.push(
+        "https://gitea.test/o/r.git", "m1", credential=HTTPSToken("pusher", token)
+    )
+    [call] = host.calls
+    assert token not in call["command"]  # never on a command line
+    assert "pusher" not in call["command"]
+    assert call["secrets"] == {"NISSE_PUSH_USER": "pusher", "NISSE_PUSH_TOKEN": token}
+    # Git asks a helper that reads the environment, and any helper configured
+    # on the VM is cleared first.
+    assert "credential.helper= " in call["command"]
+    assert "$NISSE_PUSH_TOKEN" in call["command"]
+    assert "GIT_TERMINAL_PROMPT=0" in call["command"]
+
+
+def test_an_https_token_answers_git_through_the_helper(
+    ssh_host: SSHHost, tmp_path: Path
+) -> None:
+    # The helper as git runs it, on the build host: asked to "get", it
+    # answers from the environment; asked anything else, nothing.
+    from nisse_dev.git import _HELPER
+
+    body = _HELPER.removeprefix("!")
+    asked = ssh_host.execute(
+        f"{body} get",
+        secrets={"NISSE_PUSH_USER": "pusher", "NISSE_PUSH_TOKEN": "tok-1234567"},
+    )
+    # Both travel as secrets, so both are masked in what comes back.
+    assert asked.stdout == "username=[redacted]\npassword=[redacted]\n"
+    stored = ssh_host.execute(f"{body} store", secrets={"NISSE_PUSH_TOKEN": "x"})
+    assert stored.stdout == ""