ci: keep the release token out of the push URL

[earakely-scale]

The release bump now passes its GitHub App token through a credential helper instead of embedding it in the remote URL, so the token can't appear in logs.

The URL keeps the x-access-token user name. Without it, CircleCI checkout's https://github.com → ssh rewrite would match the URL and send the push to the read-only deploy key.

This goes out as its own release, separate from the first release from this repository, so a problem here can be reverted on its own.

Test plan

• After merge, with bump-version: the bump job pushes the version commit and tag, publish goes green on the tag, and the downstream pin bump runs.

🤖 Generated with Claude Code

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking need to limit where the helper supplies the release token.

Findings

1.   Token can reach another host ▶

Fix with agent prompt

### Issue 1
scripts/circleci_release_bump.sh:27
The new `credential.helper` returns `GH_TOKEN` for any HTTPS Git host in this checkout. The bump job currently uses only GitHub, but if a later Git call uses another host, it could send that host the release token. Limit the helper to the intended host.

**How this was verified:** The helper returns `GH_TOKEN` without checking the host Git asks it to authenticate.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The release bump now gives Git its GitHub App token through a credential helper instead of putting it in the remote URL. It keeps the x-access-token username so CircleCI’s HTTPS-to-SSH rewrite does not match.

• The HTTPS remote keeps the x-access-token username but leaves out the token.
• A Git credential helper supplies GH_TOKEN as the password when Git asks.

_{Reviews (1) · Last reviewed commit: "ci: keep the release token out of the pu..."}

[greptile-apps]

Token can reach another host

The new credential.helper returns GH_TOKEN for any HTTPS Git host in this checkout. The bump job currently uses only GitHub, but if a later Git call uses another host, it could send that host the release token. Limit the helper to the intended host.

How this was verified: The helper returns GH_TOKEN without checking the host Git asks it to authenticate.

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/circleci_release_bump.sh
Line: 27

Comment:
**Token can reach another host**

The new `credential.helper` returns `GH_TOKEN` for any HTTPS Git host in this checkout. The bump job currently uses only GitHub, but if a later Git call uses another host, it could send that host the release token. Limit the helper to the intended host.

**How this was verified:** The helper returns `GH_TOKEN` without checking the host Git asks it to authenticate.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.