abrban/cloud-host
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(build): clone private git repos via $GIT_TOKEN env, not credential store

Browse Source
This commit is contained in:
keyhan
2026-06-20 23:38:11 +03:30
parent 3eff38f8d2
commit c379a2389a
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/build/build.service.ts
+8 -9
View File
@@ -556,20 +556,19 @@ export class BuildService {
const gitCopyDockerfile = useTemplated ? 'cp /dockerfile/Dockerfile /workspace-out/Dockerfile &&' : ''; const gitCopyDockerfile = useTemplated ? 'cp /dockerfile/Dockerfile /workspace-out/Dockerfile &&' : '';
// Clone command. Three cases: // Clone command. Three cases:
// • token + parseable host → token comes from $GIT_TOKEN (Secret env) via // • token (https) → the token comes from $GIT_TOKEN (Secret env) and is
// git's credential store; the clone URL stays token-free. // expanded into the clone URL *inside* the container, so the literal
// • token + unparseable host (rare) → fall back to inline token injection. // token never lands in the Job manifest/etcd. We use env expansion
// rather than a git credential store because build pods often have no
// $HOME, which silently breaks the store helper.
// • token (non-https / unparseable) → inline injection fallback.
// • no token (public repo) → plain clone. // • no token (public repo) → plain clone.
let cloneCmd: string; let cloneCmd: string;
let gitEnv: any[] | undefined; let gitEnv: any[] | undefined;
if (useGitTokenSecret) { if (useGitTokenSecret) {
gitEnv = [{ name: 'GIT_TOKEN', valueFrom: { secretKeyRef: { name: gitSecretName, key: 'token' } } }]; gitEnv = [{ name: 'GIT_TOKEN', valueFrom: { secretKeyRef: { name: gitSecretName, key: 'token' } } }];
cloneCmd = const repoNoScheme = app.gitUrl!.replace(/^https?:\/\//, '');
`git config --global credential.helper store && ` + cloneCmd = `git clone --depth 1 --branch ${branch} "https://\${GIT_TOKEN}@${repoNoScheme}" /workspace-out/source &&`;
`printf 'https://%s@%s\\n' "$GIT_TOKEN" '${gitHost}' > "$HOME/.git-credentials" && ` +
`chmod 600 "$HOME/.git-credentials" && ` +
`git clone --depth 1 --branch ${branch} '${app.gitUrl}' /workspace-out/source && ` +
`rm -f "$HOME/.git-credentials" &&`;
} else if (app.gitToken) { } else if (app.gitToken) {
const cloneUrl = app.gitUrl!.replace('https://', `https://${app.gitToken}@`); const cloneUrl = app.gitUrl!.replace('https://', `https://${app.gitToken}@`);
cloneCmd = `git clone --depth 1 --branch ${branch} ${cloneUrl} /workspace-out/source &&`; cloneCmd = `git clone --depth 1 --branch ${branch} ${cloneUrl} /workspace-out/source &&`;