@oisincoveney/pipeline 3.23.0 → 3.23.1

package/dist/factory/create-experiment.js

@@ -1,5 +1,6 @@
 import { DEFAULT_RUNNER_COMMAND_GIT_COMMITTER } from "../config/schema/catalog.js";
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -80,7 +81,7 @@ async function runCreateExperiment(options) {
 		previews,
 		...options.templateRef ? { templateRef: options.templateRef } : {},
 		templateSource
-	}));
+	}), { env: githubGitCredentialEnv() });
 	const stampedRegistryEntry = join(stampDir, STAMPED_REGISTRY_DIR, `${name}.yaml`);
 	if (!existsSync(stampedRegistryEntry)) throw new Error(`create-experiment: stamp is missing the registry entry ${STAMPED_REGISTRY_DIR}/${name}.yaml — template contract changed?`);
 	log("create-experiment: committing the stamped tree");

package/dist/factory/exec.js

@@ -3,6 +3,7 @@ import { execa } from "execa";
 //#region src/factory/exec.ts
 const defaultFactoryExec = (command, args, options) => execa(command, [...args], {
 	...options?.cwd ? { cwd: options.cwd } : {},
+	...options?.env ? { env: options.env } : {},
 	stdin: "ignore"
 });
 const defaultFactoryGit = (cwd, args) => runAuthenticatedGit(cwd, args);

package/dist/factory/git-credentials.js

@@ -0,0 +1,37 @@
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+//#region src/factory/git-credentials.ts
+const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
+/**
+* copier fetches the (private) momokaya-template by spawning its OWN git
+* subprocess (`git ls-remote` / `clone`, via plumbum). `runAuthenticatedGit`
+* only configures credentials per-invocation with `-c` flags on the git calls
+* the lane makes itself, so copier's git sees no github.com credential and
+* dies `fatal: could not read Username for 'https://github.com'`.
+*
+* This materializes a process-wide github.com credential from the runner's
+* mounted git-credentials (username + PAT under /etc/pipeline/git-credentials)
+* as `GIT_CONFIG_*` env any child (and grandchild) git process inherits, so
+* copier's template fetch authenticates. The token is written to a 0600 store
+* file and referenced by a `credential.helper=store` entry — it never lands in
+* a URL or argv. No mounted credentials (local dev) -> empty env, so git falls
+* back to ambient auth.
+*/
+function githubGitCredentialEnv(credentialsDir = process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR) {
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return {};
+	const username = readFileSync(usernamePath, "utf8").trim();
+	const password = readFileSync(passwordPath, "utf8").trim();
+	const storePath = join(mkdtempSync(join(tmpdir(), "factory-git-cred-")), ".git-credentials");
+	writeFileSync(storePath, `https://${encodeURIComponent(username)}:${encodeURIComponent(password)}@github.com\n`, { mode: 384 });
+	return {
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "credential.helper",
+		GIT_CONFIG_VALUE_0: `store --file=${storePath}`,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+}
+//#endregion
+export { githubGitCredentialEnv };

package/dist/factory/template-update.js

@@ -1,4 +1,5 @@
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { committerConfigArgs } from "./create-experiment.js";
 import { isStampOf, parseCopierAnswers } from "./stamp-answers.js";
 import { parse } from "yaml";
@@ -101,7 +102,10 @@ async function updateRepo(input) {
 			"--trust",
 			"--defaults",
 			...input.templateRef ? ["--vcs-ref", input.templateRef] : []
-		], { cwd: cloneDir });
+		], {
+			cwd: cloneDir,
+			env: githubGitCredentialEnv()
+		});
 		const status = await git(cloneDir, ["status", "--porcelain"]);
 		if (status.trim().length === 0) return {
 			repo,

package/package.json

@@ -146,7 +146,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.23.0",
+  "version": "3.23.1",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",