Method setupCredentials

src/node/runtime/DockerRuntime.ts:634–668

* Copy gitconfig and configure gh CLI credential helper in container. * Called for both new containers and reused forked containers.

(
    containerName: string,
    env?: Record<string, string>
  )

   * Called for both new containers and reused forked containers.
   */
  private async setupCredentials(
    containerName: string,
    env?: Record<string, string>
  ): Promise<void> {
    if (!this.config.shareCredentials) return;

    // Copy host gitconfig into container (not mounted, so gh can modify it).
    // Use argv-based Docker calls so credential paths/tokens never go through a host shell.
    if (hasHostGitconfig()) {
      await runSpawnCommand(
        "docker",
        ["cp", getHostGitconfigPath(), `${containerName}:/root/.gitconfig`],
        10000
      );
    }

    // Configure gh CLI as git credential helper if GH_TOKEN is available
    // GH_TOKEN can come from project secrets (env) or host environment (buildCredentialArgs)
    const ghToken = resolveGhToken(env);
    if (ghToken) {
      await runSpawnCommand(
        "docker",
        [
          "exec",
          "-e",
          `GH_TOKEN=${ghToken}`,
          containerName,
          "sh",
          "-c",
          "command -v gh >/dev/null && gh auth setup-git || true",
        ],
        10000
      );
    }
  }

  /**
   * Provision container: create, sync project, checkout branch.