gitops 1.8.0__tar.gz → 1.9.0__tar.gz

gitops-1.9.0/.release-please-manifest.json

@@ -0,0 +1,5 @@
+{
+    ".": "1.9.0",
+    "gitops_server": "0.15.1",
+    "charts/gitops": "1.3.0"
+}

{gitops-1.8.0 → gitops-1.9.0}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.9.0](https://github.com/uptick/gitops/compare/gitops-v1.8.0...gitops-v1.9.0) (2026-09-09)
+
+
+### Features
+
+* authenticate to GitHub as an App ([51ae678](https://github.com/uptick/gitops/commit/51ae678a874cf205b0f612404426c7444611f96c))
+
+
+### Bug Fixes
+
+* authenticate the repo-cache fetch, and tighten the mint ([3c1100b](https://github.com/uptick/gitops/commit/3c1100b936a3fb83eef28d3ed2732d0afaf8d607))
+* scope the credential helper to github.com ([7068133](https://github.com/uptick/gitops/commit/7068133b1a3796ffa85de191549097d2ad724f6d))
+
+
+### Documentation
+
+* cut comments back to what is not derivable from the code ([4d41784](https://github.com/uptick/gitops/commit/4d4178478da4efa37b924e3cab3da430e8ec68bd))
+
 ## [1.8.0](https://github.com/uptick/gitops/compare/gitops-v1.7.1...gitops-v1.8.0) (2026-08-21)
 
 

{gitops-1.8.0 → gitops-1.9.0}/Dockerfile

@@ -56,13 +56,7 @@ COPY --link=true pyproject.toml uv.lock /app/
 RUN --mount=type=cache,target=/root/.cache/ \
     (uv sync --frozen --no-install-project --extra server || uv sync --frozen --no-install-project --extra server)
 # Install dependencies
-# Give git the token from the environment when it asks, so it is never embedded
-# in a clone URL, a command line, a log, or a repo's .git/config. The function
-# wrapper is the documented idiom -- git appends the operation (get/store/erase)
-# as an argument, which the wrapper discards. See gitcredentials(7).
-RUN git config --global advice.detachedHead false \
-    && git config --global credential.helper \
-       '!f() { printf "username=x-access-token\npassword=%s\n" "$GITHUB_OAUTH_TOKEN"; }; f'
+RUN git config --global advice.detachedHead false
 
 COPY cluster.key /app/
 COPY gitops /app/gitops/

{gitops-1.8.0 → gitops-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gitops
-Version: 1.8.0
+Version: 1.9.0
 Summary: Manage multiple apps across one or more k8s clusters.
 Author-email: Jarek Głowacki <jarekwg@gmail.com>
 License-File: LICENSE
@@ -22,6 +22,7 @@ Requires-Dist: httpx>=0.27.0; extra == 'server'
 Requires-Dist: idna>=3.15; extra == 'server'
 Requires-Dist: kubernetes-asyncio>=25.1.2; extra == 'server'
 Requires-Dist: protobuf>=5.29.6; extra == 'server'
+Requires-Dist: pyjwt[crypto]>=2.10.0; extra == 'server'
 Requires-Dist: requests>=2.33.0; extra == 'server'
 Requires-Dist: sentry-sdk>=1.3.0; extra == 'server'
 Requires-Dist: slack-sdk>=3.33.5; extra == 'server'

{gitops-1.8.0 → gitops-1.9.0}/charts/gitops/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.3.0](https://github.com/uptick/gitops/compare/helm-v1.2.2...helm-v1.3.0) (2026-09-09)
+
+
+### Features
+
+* authenticate to GitHub as an App ([51ae678](https://github.com/uptick/gitops/commit/51ae678a874cf205b0f612404426c7444611f96c))
+
+
+### Bug Fixes
+
+* authenticate the repo-cache fetch, and tighten the mint ([3c1100b](https://github.com/uptick/gitops/commit/3c1100b936a3fb83eef28d3ed2732d0afaf8d607))
+* scope the credential helper to github.com ([7068133](https://github.com/uptick/gitops/commit/7068133b1a3796ffa85de191549097d2ad724f6d))
+
 ## [1.2.2](https://github.com/uptick/gitops/compare/helm-v1.2.1...helm-v1.2.2) (2026-05-28)
 
 

{gitops-1.8.0 → gitops-1.9.0}/charts/gitops/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: GitOps Server Helm chart.
 name: gitops
-version: 1.2.2
+version: 1.3.0

{gitops-1.8.0 → gitops-1.9.0}/charts/gitops/templates/deployment.yml

@@ -65,6 +65,11 @@ spec:
               secretKeyRef:
                 name: {{ .Release.Name }}-secret
                 key: GITHUB_OAUTH_TOKEN
+          - name: GITHUB_APP_PRIVATE_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: GITHUB_APP_PRIVATE_KEY
           - name: GITHUB_WEBHOOK_KEY
             valueFrom:
               secretKeyRef:

{gitops-1.8.0 → gitops-1.9.0}/charts/gitops/templates/secrets.yml

@@ -10,4 +10,5 @@ stringData:
   SENTRY_DSN: {{ .Values.secrets.SENTRY_DSN| quote}}
   SLACK_TOKEN: {{ .Values.secrets.SLACK_TOKEN| quote}}
 data:
-  GIT_CRYPT_KEY: {{ .Values.secrets.GIT_CRYPT_KEY | quote}}
+  GIT_CRYPT_KEY: {{ .Values.secrets.GIT_CRYPT_KEY | quote}}
+  GITHUB_APP_PRIVATE_KEY: {{ .Values.secrets.GITHUB_APP_PRIVATE_KEY | quote}}

{gitops-1.8.0 → gitops-1.9.0}/charts/gitops/values.yaml

@@ -9,11 +9,16 @@ environment:
   TZ: "UTC"
   # The channel id to send slack messages to
   SLACK_CHANNEL_ID: ""
+  # GitHub App identifiers. Empty when authenticating with a PAT.
+  GITHUB_APP_ID: ""
+  GITHUB_INSTALLATION_ID: ""
 
 secrets:
   ACCOUNT_ID: ""
   SLACK_TOKEN: ""
   GITHUB_OAUTH_TOKEN: ""
+  # base64-encoded PEM. Empty when authenticating with a PAT.
+  GITHUB_APP_PRIVATE_KEY: ""
   GITHUB_WEBHOOK_KEY: ""
   GIT_CRYPT_KEY: ""
   SENTRY_DSN: ""

{gitops-1.8.0 → gitops-1.9.0}/gitops/__init__.py

@@ -6,7 +6,7 @@ from gitops.utils.apps import App, get_app_details, get_apps  # type: ignore[att
 
 from .utils.cli import success, warning
 
-__version__ = "1.8.0"
+__version__ = "1.9.0"
 
 
 # Checking gitops version matches cluster repo version.

{gitops-1.8.0 → gitops-1.9.0}/gitops_server/app.py

@@ -1,4 +1,5 @@
 import asyncio
+import logging
 import os
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
@@ -9,12 +10,19 @@ from sentry_sdk.integrations.asgi import SentryAsgiMiddleware
 
 from . import settings
 
+logger = logging.getLogger("gitops")
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     """Manage application lifespan - start and stop background workers."""
+    from .utils.github_auth import credentials, validate_credentials
     from .workers import DeployQueueWorker
 
+    # Fail here rather than on the first push, where hooks.py only logs a warning.
+    validate_credentials()
+    logger.info("GitHub authentication: %s", credentials.describe())
+
     loop = asyncio.get_running_loop()
     deploy_queue_worker = DeployQueueWorker.get_worker()
     deploy_queue_worker_task = asyncio.ensure_future(deploy_queue_worker.run(), loop=loop)

{gitops-1.8.0 → gitops-1.9.0}/gitops_server/utils/__init__.py

@@ -1,5 +1,6 @@
 import asyncio
 import logging
+import os
 from collections.abc import Callable
 from pathlib import Path
 
@@ -19,16 +20,28 @@ async def _read_stream(stream: asyncio.StreamReader | None, cb: Callable[[bytes]
             break
 
 
-async def run(command: str, suppress_errors: bool = False, cwd: str | Path | None = None) -> RunOutput:
+async def run(
+    command: str,
+    suppress_errors: bool = False,
+    cwd: str | Path | None = None,
+    env: dict[str, str] | None = None,
+) -> RunOutput:
     """Run a shell command.
 
     Runs the command in an asyncio executor to keep things async. Will
     optionally prevent raising an exception on failure with `suppress_errors`.
+
+    `env` is overlaid on the current environment, so a caller can hand one command
+    a credential without putting it in argv.
     """
     exit_code = 0
     logger.info(f'Running "{command}".')
     proc = await asyncio.create_subprocess_shell(
-        command, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=cwd
+        command,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+        cwd=cwd,
+        env={**os.environ, **env} if env else None,
     )
     stdout, stderr = b"", b""
 

{gitops-1.8.0 → gitops-1.9.0}/gitops_server/utils/git.py

@@ -10,6 +10,7 @@ from pathlib import Path
 from opentelemetry.trace import get_tracer
 
 from . import run
+from .github_auth import credentials
 
 tracer = get_tracer(__name__)
 logger = logging.getLogger("gitops")
@@ -26,17 +27,29 @@ GIT_CRYPT_MAGIC = b"\0GITCRYPT\0"
 decrypt_semaphore = asyncio.Semaphore(16)
 
 
+async def credential_env(git_repo_url: str) -> dict[str, str] | None:
+    """Credentials for a git subprocess, or None for a remote that needs none.
+
+    Local paths in tests are not GitHub, and asking would mint a token for nothing.
+    """
+    if "://" not in git_repo_url:
+        return None
+    return await credentials.git_env()
+
+
 async def clone_repo(git_repo_url: str, path: str, sha: str | None = None, branch: str | None = None) -> None:
     """Shallow Clones a git repo url to path and git-crypt unlocks all encrypted files"""
     logger.info(f'Cloning "{git_repo_url}".')
 
+    env = await credential_env(git_repo_url)
+
     with tracer.start_as_current_span("tempo_repo.clone_repo"):
         if sha:
-            await run(f"git clone --depth 100 {git_repo_url} {path}; cd {path}; git checkout {sha}")
+            await run(f"git clone --depth 100 {git_repo_url} {path}; cd {path}; git checkout {sha}", env=env)
         elif branch:
-            await run(f"git clone --depth 1 {git_repo_url} {path} --branch {branch}")
+            await run(f"git clone --depth 1 {git_repo_url} {path} --branch {branch}", env=env)
         else:
-            await run(f"git clone --depth 100 {git_repo_url} {path};")
+            await run(f"git clone --depth 100 {git_repo_url} {path};", env=env)
 
     if GIT_CRYPT_KEY_FILE := os.environ.get("GIT_CRYPT_KEY_FILE"):
         with tracer.start_as_current_span("temp_repo.git_crypt_unlock"):
@@ -74,7 +87,7 @@ async def temp_repo(git_repo_url: str, ref: str | None) -> AsyncGenerator[str, N
             yield temporary_folder_path
 
 
-async def _git(repo: str, *args: str, stdin: bytes | None = None) -> bytes:
+async def _git(repo: str, *args: str, stdin: bytes | None = None, env: dict[str, str] | None = None) -> bytes:
     """Run git in `repo`, returning raw stdout.
 
     Not `run()`: blobs are binary, and `run()` decodes and logs every line.
@@ -87,6 +100,7 @@ async def _git(repo: str, *args: str, stdin: bytes | None = None) -> bytes:
         stdin=asyncio.subprocess.PIPE if stdin is not None else None,
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.PIPE,
+        env={**os.environ, **env} if env else None,
     )
     stdout, stderr = await proc.communicate(stdin)
     if proc.returncode != 0:
@@ -110,7 +124,8 @@ async def ensure_repo_cache(git_repo_url: str, ref: str) -> str:
             await _git(str(cache_path), "cat-file", "-e", f"{ref}^{{commit}}")
         except Exception:
             logger.info("Ref %s not in cache, fetching", ref)
-            await _git(str(cache_path), "fetch", "--quiet", "origin")
+            env = await credential_env(git_repo_url)
+            await _git(str(cache_path), "fetch", "--quiet", "origin", env=env)
     return str(cache_path)
 
 

{gitops-1.8.0 → gitops-1.9.0}/gitops_server/utils/github.py

@@ -1,11 +1,10 @@
 import logging
-import os
 
 import httpx
 
-logger = logging.getLogger("github")
+from gitops_server.utils.github_auth import credentials
 
-GITHUB_OAUTH_TOKEN = os.environ.get("GITHUB_OAUTH_TOKEN")
+logger = logging.getLogger("github")
 
 
 class IssueNotFound(Exception): ...
@@ -19,10 +18,9 @@ class STATUSES:
     error = "error"  # when error during helm deploy
 
 
-def get_headers() -> dict[str, str]:
+async def get_headers() -> dict[str, str]:
     return {
-        "Authorization": f"token {GITHUB_OAUTH_TOKEN}",
-        "Content-Type": "application/json",
+        **await credentials.headers(),
         "Accept": ("application/vnd.github.flash-preview+json, application/vnd.github.ant-man-preview+json"),
     }
 
@@ -43,7 +41,7 @@ async def update_deployment(deployment_url: str, status: str, description: str,
         response = await client.post(
             status_url,
             json=data,
-            headers=get_headers(),
+            headers=await get_headers(),
         )
         if response.status_code >= 300 and response.status_code != 404:
             try:

gitops-1.9.0/gitops_server/utils/github_auth.py

@@ -0,0 +1,133 @@
+"""GitHub credentials: a PAT in GITHUB_OAUTH_TOKEN when set, otherwise an App
+installation token minted from the private key and cached until near expiry.
+"""
+
+import asyncio
+import logging
+import os
+import time
+from datetime import datetime
+
+import httpx
+import jwt
+
+logger = logging.getLogger("github_auth")
+
+GITHUB_API = "https://api.github.com"
+# Refresh with this much left, so a slow deploy never loses its token mid-flight.
+MIN_REMAINING_SECONDS = 30 * 60
+# GitHub rejects an App JWT that lives longer than this.
+APP_JWT_TTL_SECONDS = 10 * 60
+GIT_CREDENTIAL_ENV_VAR = "GITHUB_OAUTH_TOKEN"
+
+# The credential helper travels with the token rather than living in the image, so
+# it cannot drift from the code that supplies it. Scoped to github.com: an unscoped
+# helper answers for every host git reaches, including across a redirect.
+_CREDENTIAL_HELPER = f'!f() {{ printf "username=x-access-token\\npassword=%s\\n" "${GIT_CREDENTIAL_ENV_VAR}"; }}; f'
+_HELPER_CONFIG = {
+    "GIT_CONFIG_COUNT": "2",
+    # An empty value resets the helper list. Without it git keeps whatever helper the
+    # environment already configures -- macOS ships credential.helper=osxkeychain in
+    # the Command Line Tools gitconfig -- and takes that answer instead of ours.
+    "GIT_CONFIG_KEY_0": "credential.helper",
+    "GIT_CONFIG_VALUE_0": "",
+    "GIT_CONFIG_KEY_1": "credential.https://github.com.helper",
+    "GIT_CONFIG_VALUE_1": _CREDENTIAL_HELPER,
+}
+
+
+class GitHubCredentials:
+    """Supplies a token for API calls and git clones, refreshing as needed.
+
+    Reads the environment on use, not at import, so a deployment can be swapped
+    between the PAT and the App without a code change or a restart.
+    """
+
+    def __init__(self) -> None:
+        self._token: str | None = None
+        self._expires_at: float = 0.0
+        # Without this two callers both find the cache stale and both mint.
+        self._lock = asyncio.Lock()
+
+    @property
+    def uses_app(self) -> bool:
+        return not os.environ.get("GITHUB_OAUTH_TOKEN", "").strip()
+
+    def describe(self) -> str:
+        if not self.uses_app:
+            return "GITHUB_OAUTH_TOKEN (personal access token)"
+        return (
+            f"GitHub App {os.environ.get('GITHUB_APP_ID', '')} "
+            f"installation {os.environ.get('GITHUB_INSTALLATION_ID', '')}"
+        )
+
+    def _app_jwt(self) -> str:
+        now = int(time.time())
+        return jwt.encode(
+            {"iat": now - 60, "exp": now + APP_JWT_TTL_SECONDS, "iss": os.environ.get("GITHUB_APP_ID", "")},
+            os.environ.get("GITHUB_APP_PRIVATE_KEY", ""),
+            algorithm="RS256",
+        )
+
+    def _is_fresh(self) -> bool:
+        return bool(self._token) and time.time() < (self._expires_at - MIN_REMAINING_SECONDS)
+
+    async def token(self) -> str:
+        if not self.uses_app:
+            return os.environ["GITHUB_OAUTH_TOKEN"].strip()
+        if self._is_fresh():
+            assert self._token is not None
+            return self._token
+
+        async with self._lock:
+            # Another caller may have minted while we waited.
+            if self._is_fresh():
+                assert self._token is not None
+                return self._token
+
+            async with httpx.AsyncClient(timeout=30.0) as client:
+                response = await client.post(
+                    f"{GITHUB_API}/app/installations/{os.environ.get('GITHUB_INSTALLATION_ID', '')}/access_tokens",
+                    headers={
+                        "Authorization": f"Bearer {self._app_jwt()}",
+                        "Accept": "application/vnd.github+json",
+                    },
+                )
+                response.raise_for_status()
+                data = response.json()
+
+            token = str(data["token"])
+            self._token = token
+            self._expires_at = datetime.fromisoformat(data["expires_at"].replace("Z", "+00:00")).timestamp()
+            logger.info("GitHub installation token refreshed, expires at %s", data["expires_at"])
+            return token
+
+    async def headers(self) -> dict[str, str]:
+        return {
+            "Authorization": f"Bearer {await self.token()}",
+            "Content-Type": "application/json",
+        }
+
+    async def git_env(self) -> dict[str, str]:
+        """Minted per command, so a long-lived process never pins an expiring token."""
+        return {GIT_CREDENTIAL_ENV_VAR: await self.token(), **_HELPER_CONFIG}
+
+
+def validate_credentials() -> None:
+    if os.environ.get("GITHUB_OAUTH_TOKEN", "").strip():
+        return
+    required = ("GITHUB_APP_ID", "GITHUB_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY")
+    if missing := [name for name in required if not os.environ.get(name)]:
+        raise RuntimeError(
+            "No GitHub credential configured: set GITHUB_OAUTH_TOKEN, or all of "
+            f"{', '.join(required)} (missing: {', '.join(missing)})"
+        )
+    # Signing parses the key, so an unusable one fails here rather than on the
+    # first deploy. A revoked key or a wrong id still only surfaces on first use.
+    try:
+        credentials._app_jwt()
+    except Exception as exc:
+        raise RuntimeError(f"GITHUB_APP_PRIVATE_KEY cannot sign a JWT: {exc}") from exc
+
+
+credentials = GitHubCredentials()

gitops-1.9.0/gitops_server/version.py

@@ -0,0 +1 @@
+__version__ = "1.9.0"

{gitops-1.8.0 → gitops-1.9.0}/gitops_server/workers/deployer/hooks.py

@@ -21,7 +21,7 @@ logger = logging.getLogger(__name__)
 
 async def update_issue_from_deployment_url(app: App, deployment_url: str, **kwargs: Any) -> None:
     async with httpx.AsyncClient() as client:
-        headers = github.get_headers()
+        headers = await github.get_headers()
         deployment_response = await client.get(deployment_url, headers=headers)
         try:
             sha = deployment_response.json().get("sha", "")

{gitops-1.8.0 → gitops-1.9.0}/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "gitops"
-version = "1.8.0"
+version = "1.9.0"
 description = "Manage multiple apps across one or more k8s clusters."
 requires-python = ">=3.12"
 readme = "README.md"
@@ -32,6 +32,8 @@ server = [
     "sentry-sdk>=1.3.0",
     "uptick-observability[fastapi]>=0.2.2",
     "slack-sdk>=3.33.5",
+    # Signs the JWT exchanged for a GitHub App installation token
+    "pyjwt[crypto]>=2.10.0",
     # Transitive security pins
     "h11>=0.16.0",
     "aiohttp>=3.14.0",

gitops-1.9.0/tests/test_clone_credentials.py

@@ -0,0 +1,109 @@
+import os
+import subprocess
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+import gitops_server.utils.git as git
+from gitops_server.utils.github_auth import credentials
+
+TOKEN = "ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"  # noqa: S105
+URL = "https://github.com/uptick/uptick-cluster.git"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("kwargs", [{}, {"sha": "a" * 40}, {"branch": "master"}])
+async def test_clone_command_never_contains_the_token(monkeypatch, kwargs):
+    """Credentials reach git through a helper supplied in the environment, so
+    nothing run() logs, raises or returns can carry the token."""
+    monkeypatch.setenv("GITHUB_OAUTH_TOKEN", TOKEN)
+    monkeypatch.delenv("GIT_CRYPT_KEY_FILE", raising=False)
+    with patch.object(git, "run", new=AsyncMock()) as run_mock:
+        await git.clone_repo(URL, path="/tmp/x", **kwargs)
+
+    # run() logs only the command, so only the command must stay clean.
+    commands = " ".join(str(call.args) for call in run_mock.call_args_list)
+    assert TOKEN not in commands
+    assert URL in commands
+
+    # It arrives the one way that is not logged: the environment.
+    # What that environment configures is asserted against real git below.
+    for call in run_mock.call_args_list:
+        assert call.kwargs["env"]["GITHUB_OAUTH_TOKEN"] == TOKEN
+
+
+@pytest.mark.asyncio
+async def test_local_path_clone_needs_no_credential(monkeypatch):
+    """A local path is not GitHub; asking for a credential would mint one needlessly."""
+    monkeypatch.delenv("GITHUB_OAUTH_TOKEN", raising=False)
+    monkeypatch.delenv("GIT_CRYPT_KEY_FILE", raising=False)
+    with patch.object(git, "run", new=AsyncMock()) as run_mock:
+        await git.clone_repo("/tmp/some/local/repo", path="/tmp/x")
+    assert all(call.kwargs["env"] is None for call in run_mock.call_args_list)
+
+
+def test_the_image_holds_no_credential():
+    """The helper ships with the token now, so nothing about it is baked in."""
+    dockerfile = (Path(__file__).parent.parent / "Dockerfile").read_text()
+    assert "credential" not in dockerfile
+    assert "GITHUB_OAUTH_TOKEN" not in dockerfile
+    assert "ghp_" not in dockerfile
+
+
+@pytest.mark.asyncio
+async def test_cache_fetch_authenticates(monkeypatch, tmp_path):
+    """The shared repo cache fetches new refs, and that fetch hits the remote."""
+    monkeypatch.setenv("GITHUB_OAUTH_TOKEN", TOKEN)
+    monkeypatch.setattr(git, "REPO_CACHE_DIR", tmp_path)
+    (tmp_path / "uptick-cluster" / ".git").mkdir(parents=True)
+
+    async def fake_git(repo, *args, **kwargs):
+        if args[0] == "cat-file":
+            raise Exception("ref not in cache")
+        return b""
+
+    with patch.object(git, "_git", new=AsyncMock(side_effect=fake_git)) as git_mock:
+        await git.ensure_repo_cache(URL, ref="a" * 40)
+
+    fetch = next(c for c in git_mock.call_args_list if c.args[1] == "fetch")
+    assert fetch.kwargs["env"]["GITHUB_OAUTH_TOKEN"] == TOKEN
+
+
+def git_credential_fill(env: dict[str, str], host: str) -> dict[str, str]:
+    """What real git would use for `host`, given this environment.
+
+    Asserting on the config strings only proves we wrote what we meant to write.
+    This proves git parses it and answers with it.
+    """
+    proc = subprocess.run(  # noqa: S603
+        ["git", "credential", "fill"],  # noqa: S607
+        input=f"protocol=https\nhost={host}\n\n",
+        capture_output=True,
+        text=True,
+        env={
+            **os.environ,
+            **env,
+            "GIT_TERMINAL_PROMPT": "0",
+        },
+        check=False,
+    )
+    return dict(line.split("=", 1) for line in proc.stdout.splitlines() if "=" in line)
+
+
+@pytest.mark.asyncio
+async def test_git_accepts_the_helper_we_ship(monkeypatch):
+    monkeypatch.setenv("GITHUB_OAUTH_TOKEN", TOKEN)
+    answer = git_credential_fill(await credentials.git_env(), "github.com")
+
+    assert answer["username"] == "x-access-token"
+    assert answer["password"] == TOKEN
+
+
+@pytest.mark.asyncio
+async def test_git_offers_the_token_to_no_other_host(monkeypatch):
+    """The helper is keyed on github.com, so a redirect elsewhere gets nothing."""
+    monkeypatch.setenv("GITHUB_OAUTH_TOKEN", TOKEN)
+    answer = git_credential_fill(await credentials.git_env(), "not-github.example.com")
+
+    assert answer.get("password") != TOKEN