@sonar-autofix/git-client 0.0.1 → 0.2.2

package/index.js

@@ -13,6 +13,7 @@ class GitClient {
    * @param {object} [config]
    * @param {object} [config.git]
    * @param {string} [config.git.branch]
+   * @param {string} [config.git.baseBranch]
    * @param {string} [config.git.token]
    * @param {string} [config.git.username]
    * @param {string} [config.git.remote='origin']
@@ -51,6 +52,18 @@ class GitClient {
     );
   }
 
+  /**
+   * Get the base branch for pull requests.
+   *
+   * Returns the configured base branch (config.git.baseBranch),
+   * or undefined when it is not set in the configuration.
+   *
+   * @returns {string|undefined}
+   */
+  _getBaseBranch() {
+    return this.config.git.baseBranch;
+  }
+
   /**
    * Get Git username.
    *
@@ -74,29 +87,15 @@ class GitClient {
    * @returns {Promise<string>}
    */
   async _execGit(args) {
-    try {
-      var env = Object.assign({}, process.env);
-
-      var token = this._getToken();
-
-      if (token) {
-        env.GIT_TERMINAL_PROMPT = '0';
-
-        /*
-         * GIT_ASKPASS prevents Git from prompting for credentials.
-         * The actual token is supplied through environment variables.
-         */
-        env.GIT_USERNAME = this._getUsername();
-        env.GIT_PASSWORD = token;
+    var env = Object.assign({}, process.env);
 
-        env.GIT_ASKPASS = 'git-askpass-helper';
-
-        /*
-         * This is handled by the shell-independent askpass mechanism
-         * below when the executable is available.
-         */
-      }
+    /*
+     * Never hang on an interactive credential prompt.
+     * Authentication is supplied per-command (see push()).
+     */
+    env.GIT_TERMINAL_PROMPT = '0';
 
+    try {
       var result = await execFile('git', args, {
         cwd: this.cwd,
         env: env
@@ -104,8 +103,8 @@ class GitClient {
 
       return (result.stdout || '').trim();
     } catch (err) {
-      var command = 'git ' + args.join(' ');
-      var stderr = (err.stderr || '').trim();
+      var command = this._redactSecrets('git ' + args.join(' '));
+      var stderr = this._redactSecrets((err.stderr || '').trim());
 
       throw new Error(
           'Git command failed: ' +
@@ -115,6 +114,64 @@ class GitClient {
     }
   }
 
+  /**
+   * Remove any configured secrets from a string so they never leak
+   * into logs or error messages.
+   *
+   * @param {string} value
+   * @returns {string}
+   */
+  _redactSecrets(value) {
+    if (!value) {
+      return value;
+    }
+
+    var token = this._getToken();
+
+    if (token && value.indexOf(token) !== -1) {
+      value = value.split(token).join('[REDACTED]');
+    }
+
+    return value;
+  }
+
+  /**
+   * Build an authenticated push URL by embedding the GitHub token.
+   *
+   * This lets Git authenticate with the token directly instead of
+   * prompting for a username and password. Only HTTP(S) remotes are
+   * eligible; other remotes (e.g. SSH) return null and fall back to a
+   * normal push.
+   *
+   * @returns {Promise<string|null>}
+   */
+  async _getAuthenticatedUrl() {
+    var token = this._getToken();
+
+    if (!token) {
+      return null;
+    }
+
+    var url;
+    try {
+      url = await this._execGit(['remote', 'get-url', this.config.git.remote]);
+    } catch (err) {
+      return null;
+    }
+
+    var match = url.match(/^https?:\/\/(?:[^@\/]+@)?([^\/]+?)\/(.+)$/);
+
+    if (!match) {
+      return null;
+    }
+
+    var host = match[1];
+    var path = match[2];
+    var user = this._getUsername();
+
+    return 'https://' + user + ':' + token + '@' + host + '/' + path;
+  }
+
   /**
    * Execute GitHub CLI command.
    *
@@ -140,7 +197,9 @@ class GitClient {
 
       var result = await execFile('gh', args, {
         cwd: this.cwd,
-        env: env
+        env: env,
+        encoding: 'utf8',
+        stdio: 'pipe',
       });
 
       return (result.stdout || '').trim();
@@ -150,7 +209,8 @@ class GitClient {
       throw new Error(
           'GitHub CLI command failed: ' +
           ['gh'].concat(args).join(' ') +
-          (stderr ? '\n' + stderr : '')
+          (stderr ? '\n' + stderr : '') + '-' +
+          err.message
       );
     }
   }
@@ -215,6 +275,11 @@ class GitClient {
   /**
    * Push branch to remote.
    *
+   * When a GitHub token is available and the remote is HTTP(S), the
+   * branch is pushed to a token-authenticated URL so Git authenticates
+   * with the token directly instead of a username/password. For other
+   * remotes (e.g. SSH) it falls back to a normal `git push <remote>`.
+   *
    * @param {string} [branchName]
    * @param {boolean} [force=false]
    * @returns {Promise<string>}
@@ -223,10 +288,18 @@ class GitClient {
     var branch = branchName || this.config.git.branch;
     var remote = this.config.git.remote;
 
-    var args = ['push', remote, branch];
+    var args = ['push'];
 
     if (force) {
-      args.splice(1, 0, '--force');
+      args.push('--force');
+    }
+
+    var authUrl = await this._getAuthenticatedUrl();
+
+    if (authUrl) {
+      args.push(authUrl, branch);
+    } else {
+      args.push(remote, branch);
     }
 
     return this._execGit(args);
@@ -279,9 +352,14 @@ class GitClient {
    * The token is passed through the environment and never
    * appears in the command line.
    *
+   * The base branch is resolved in the following order:
+   *   1. The baseBranch argument (when provided by the caller).
+   *   2. config.git.baseBranch from the configuration file.
+   *   3. The current git branch (the branch the CLI is running in).
+   *
    * @param {string} title
    * @param {string} body
-   * @param {string} [baseBranch='main']
+   * @param {string} [baseBranch]
    * @returns {Promise<string>}
    */
   async createPullRequest(title, body, baseBranch) {
@@ -301,7 +379,10 @@ class GitClient {
       );
     }
 
-    var base = baseBranch || 'main';
+    var base =
+        baseBranch ||
+        this._getBaseBranch() ||
+        (await this.getCurrentBranch());
 
     return this._execGh([
       'pr',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonar-autofix/git-client",
-  "version": "0.0.1",
+  "version": "0.2.2",
   "description": "Git client for the Sonar Autofix tool",
   "main": "index.js",
   "scripts": {
@@ -14,4 +14,4 @@
   ],
   "author": "Sonar Autofix Team",
   "license": "MIT"
-}
+}