Hide credentials in Git endpoint diagnostics

publish_test.go

@@ -332,6 +332,27 @@ func TestPublishRejectsUnexpectedPushURLBeforeValidation(t *testing.T) {
 	}
 }
 
+func TestPublishRedactsCredentialsInEndpointMismatch(t *testing.T) {
+	repo := newPublishFixture(t)
+	resolved := "https://actual-user:actual-secret@example.invalid/project.git"
+	expected := "https://expected-token@example.invalid/project.git"
+	gitRun(t, repo.work, "remote", "set-url", "--push", "origin", resolved)
+	result, err := releasekit.Publish(context.Background(), releasekit.ReleaseRequest{
+		RepositoryDir: repo.work, Product: "Sample App", Version: "v1.2.3", ExpectedPushURL: expected,
+	})
+	if !errors.Is(err, releasekit.ErrUnexpectedPushURL) || result.Endpoint != resolved || result.State != releasekit.PublicationNotAttempted {
+		t.Fatalf("mismatch result = %#v, error = %v", result, err)
+	}
+	for _, secret := range []string{"actual-user", "actual-secret", "expected-token"} {
+		if strings.Contains(err.Error(), secret) {
+			t.Fatalf("diagnostic exposes %q: %v", secret, err)
+		}
+	}
+	if !strings.Contains(err.Error(), "example.invalid/project.git") {
+		t.Fatalf("diagnostic lacks endpoint context: %v", err)
+	}
+}
+
 func TestPublishComparesExpectedURLWithResolvedInsteadOfDestination(t *testing.T) {
 	repo := newPublishFixture(t)
 	alias := "releasekit-expected-push:"