[EXP-23262]: S7: support subrepo cloning via GH_USER / GH_TOKEN

[oleksandrhleba]

Ticket link

EXP-23262

Summary

Adds native support in s7 for authenticating GitHub subrepo network operations over HTTPS with a Personal Access Token, instead of relying on an SSH key.

When S7_GIT_USER + S7_GIT_TOKEN (or the GH_USER / GH_TOKEN fallback) are present, s7 makes git rewrite SSH github.com URLs to HTTPS and supplies the PAT as an HTTP Authorization header. When they're absent, behavior is unchanged — SSH as before.

How it works

All git invocations funnel through +[GitRepository runGitWithArguments:…]. When both credentials are present, s7 injects three GIT_CONFIG_* entries into the child git process's environment:

• url.https://github.com/.insteadOf = git@github.com:
• url.https://github.com/.insteadOf = ssh://git@github.com/
• http.https://github.com/.extraheader = Authorization: Basic base64(user:token)

insteadOf moves the subrepo URL onto HTTPS transport; the github.com‑scoped extraheader authenticates it — the same approach actions/checkout uses. This is git ≥ 2.31's env-based config; no git config file is touched.

Security properties

• Token never in a URL — it rides in an HTTP header, so it can't leak through git error messages, GIT_TRACE_CURL, or remote.origin.url. base64 (not percent-encoded creds in a URL) also means arbitrary token bytes are safe.
• Token never in argv — delivered via environment, not -c, so it can't appear in ps / /proc / crash reports.
• Token never on disk — .git/config and .s7substate keep the original SSH URL; the rewrite is resolution-time only.
• Header scoped to github.com — never attached to a redirect or other host.

Behavior details

• No-op off the token path. With no credentials, task.environment is left untouched, so dev machines and SSH users are completely unaffected.
• Composes with inherited config. New entries append past any existing GIT_CONFIG_COUNT, so a nested s7 (which inherits the parent's injected config) or any other tool's GIT_CONFIG_* is never clobbered.
• Diagnostic. On the token path, s7 prints s7: subrepo network auth: HTTPS via token to stderr (once) so CI auth failures are easy to spot.

Testing

• Unit tests (gitGitHubTokenAuthTests.m): the config builder produces the correct entries, appends past an existing count, and the raw token never appears outside the base64 header. Builds clean under -Werror.
• Manually verified end-to-end against a real PAT on a clone of rd2 (SSH disabled via GIT_SSH_COMMAND=false to prove the HTTPS path).

Scope & follow-ups

• No automated CI smoke against a live PAT yet — recommend adding a gated git ls-remote check.

[pastey]

I'm still not sure if we need GH_USER/GH_TOKEN in the s7 code. What are your thoughts?

[pastey]

maybe a nitpicking, but anyway...
s7 spawns many git operations during its work. Now we will run this env calculation on every git call, even though it will produce exactly the same result we call it. We already have dispatch_once in some of the new methods, so probably would be ok to add "once" here too. It may affect the unit tests and require some refactoring.

[pastey]

Please document the new env variables in the printHelp in main.m. From the client's standpoint.

[pastey]

comment seems to have been copy/pasted. Tells about the token. I would rather remove both comments. If we change the code, the comment will get outdated.

[pastey]

envGitHubTokenAuthEnabled method seems to be an overkill for a single time usage.
const BOOL envGitHubTokenAuthEnabled = [self envGitAuthUser].length > 0 && [self envGitAuthToken].length > 0; would be just fine.

[pastey]

please use logInfo instead.

[pastey]

instead of passing existingConfigCount argument, I would directly access the

NSDictionary<NSString *, NSString *> *const env = NSProcessInfo.processInfo.environment;
        const NSInteger existingConfigCount = MAX(0, [env[@"GIT_CONFIG_COUNT"] integerValue]);

here. This way all the logic managing GIT_CONFIG_COUNT would be in a single place. Now it's spread out by two methods.
Plus NSInteger seems odd. Why not unsigned?

[pastey]

can we move this down to 1576, where it's actually used?

[pastey]

I'd rather add a local closure that will take key/value, and incapsulate this logic. Something like:

__block nextConfigPairIndex = MAX(0, ...);
__auto_type addConfigKV = ^(NSString *key, NSString *value) {
          result[[NSString stringWithFormat:@"GIT_CONFIG_KEY_%ld", (long)nextConfigPairIndex]] = key;
        result[[NSString stringWithFormat:@"GIT_CONFIG_VALUE_%ld", (long)nextConfigPairIndex]] = value;
        ++nextConfigPairIndex;
};

addConfigKV(url, authorization);