fix(build): clone private git repos via $GIT_TOKEN env, not credential store

backend/src/build/build.service.ts

@@ -556,20 +556,19 @@ export class BuildService {
       const gitCopyDockerfile = useTemplated ? 'cp /dockerfile/Dockerfile /workspace-out/Dockerfile &&' : '';
 
       // Clone command. Three cases:
-      //  • token + parseable host → token comes from $GIT_TOKEN (Secret env) via
-      //    git's credential store; the clone URL stays token-free.
-      //  • token + unparseable host (rare) → fall back to inline token injection.
+      //  • token (https) → the token comes from $GIT_TOKEN (Secret env) and is
+      //    expanded into the clone URL *inside* the container, so the literal
+      //    token never lands in the Job manifest/etcd. We use env expansion
+      //    rather than a git credential store because build pods often have no
+      //    $HOME, which silently breaks the store helper.
+      //  • token (non-https / unparseable) → inline injection fallback.
       //  • no token (public repo) → plain clone.
       let cloneCmd: string;
       let gitEnv: any[] | undefined;
       if (useGitTokenSecret) {
         gitEnv = [{ name: 'GIT_TOKEN', valueFrom: { secretKeyRef: { name: gitSecretName, key: 'token' } } }];
-        cloneCmd =
-          `git config --global credential.helper store && ` +
-          `printf 'https://%s@%s\\n' "$GIT_TOKEN" '${gitHost}' > "$HOME/.git-credentials" && ` +
-          `chmod 600 "$HOME/.git-credentials" && ` +
-          `git clone --depth 1 --branch ${branch} '${app.gitUrl}' /workspace-out/source && ` +
-          `rm -f "$HOME/.git-credentials" &&`;
+        const repoNoScheme = app.gitUrl!.replace(/^https?:\/\//, '');
+        cloneCmd = `git clone --depth 1 --branch ${branch} "https://\${GIT_TOKEN}@${repoNoScheme}" /workspace-out/source &&`;
       } else if (app.gitToken) {
         const cloneUrl = app.gitUrl!.replace('https://', `https://${app.gitToken}@`);
         cloneCmd = `git clone --depth 1 --branch ${branch} ${cloneUrl} /workspace-out/source &&`;