Function withGitToken

packages/bumpy/src/core/git.ts:42–104

(cwd: string | undefined, fn: () => void)

 * used instead of the default GITHUB_TOKEN.
 */
export function withGitToken(cwd: string | undefined, fn: () => void): void {
  const token = process.env.BUMPY_GH_TOKEN || process.env.GH_TOKEN;
  const server = process.env.GITHUB_SERVER_URL || 'https://github.com';

  if (!token) {
    fn();
    return;
  }

  const extraHeaderKey = `http.${server}/.extraheader`;

  // Save and clear any existing credential config set by actions/checkout:
  //   1. Direct http.<server>/.extraheader in local config
  //   2. includeIf.gitdir entries pointing to credential config files
  const savedHeader = tryRunArgs(['git', 'config', '--local', extraHeaderKey], { cwd });

  const includeIfRaw = tryRunArgs(['git', 'config', '--local', '--get-regexp', '^includeif\\.gitdir:'], { cwd });
  const savedIncludeIfs: Array<{ key: string; value: string }> = [];
  if (includeIfRaw) {
    for (const line of includeIfRaw.split('\n').filter(Boolean)) {
      const spaceIdx = line.indexOf(' ');
      if (spaceIdx > 0) {
        savedIncludeIfs.push({ key: line.slice(0, spaceIdx), value: line.slice(spaceIdx + 1) });
      }
    }
  }

  // Rewrite the remote URL to embed the token — this is the most reliable
  // auth method as it bypasses all credential helpers and extraheader issues
  const originalUrl = tryRunArgs(['git', 'remote', 'get-url', 'origin'], { cwd });
  const authedUrl = originalUrl ? originalUrl.replace(/^https:\/\//, `https://x-access-token:${token}@`) : null;

  try {
    if (savedHeader) {
      runArgs(['git', 'config', '--local', '--unset-all', extraHeaderKey], { cwd });
    }
    for (const entry of savedIncludeIfs) {
      tryRunArgs(['git', 'config', '--local', '--unset', entry.key], { cwd });
    }
    if (authedUrl) {
      runArgs(['git', 'remote', 'set-url', 'origin', authedUrl], { cwd });
    }
    try {
      fn();
    } catch (err) {
      // Redact token from error messages to prevent leakage in CI logs
      const msg = err instanceof Error ? err.message : String(err);
      throw new Error(msg.replaceAll(token, '***'));
    }
  } finally {
    // Restore original remote URL
    if (originalUrl) {
      runArgs(['git', 'remote', 'set-url', 'origin', originalUrl], { cwd });
    }
    // Restore previous credential config
    if (savedHeader) {
      runArgs(['git', 'config', '--local', extraHeaderKey, savedHeader], { cwd });
    }