Hide credentials in checkout preparation errors

preparation_test.go

@@ -3,17 +3,55 @@ package releasekit_test
 import (
 	"context"
 	"errors"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	releasekit "go.maximumdirect.net/releasekit"
 )
 
+func TestPrepareTaggedCheckoutRedactsRemoteCredentials(t *testing.T) {
+	t.Setenv("NO_PROXY", "*")
+	t.Setenv("no_proxy", "*")
+	t.Setenv("GIT_CONFIG_GLOBAL", os.DevNull)
+	t.Setenv("GIT_CONFIG_NOSYSTEM", "1")
+	t.Setenv("GIT_TERMINAL_PROMPT", "0")
+	repo := newPublishFixture(t)
+	var authenticated atomic.Bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, password, ok := r.BasicAuth()
+		if !ok {
+			w.Header().Set("WWW-Authenticate", `Basic realm="fixture"`)
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		if user != "review-user" || password != "review-password" {
+			t.Error("fetch did not preserve the configured credentials")
+		}
+		authenticated.Store(true)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer server.Close()
+	remote := strings.Replace(server.URL, "http://", "http://review-user:review-password@", 1) + "/repo.git"
+	err := releasekit.PrepareTaggedCheckout(t.Context(), releasekit.TaggedCheckoutRequest{
+		RepositoryDir: repo.work, Tag: "v1.2.3", Remote: remote, ExpectedCommit: repo.commit,
+	})
+	var exit *exec.ExitError
+	if !errors.As(err, &exit) || !authenticated.Load() || !strings.Contains(err.Error(), "v1.2.3") || !strings.Contains(err.Error(), "repo.git") {
+		t.Fatalf("preparation failure = %v, authenticated = %t", err, authenticated.Load())
+	}
+	if strings.Contains(err.Error(), "review-user") || strings.Contains(err.Error(), "review-password") {
+		t.Fatalf("preparation diagnostic exposes credentials: %v", err)
+	}
+}
+
 func TestPrepareBuildDependenciesCancellationReleasesInheritedOutput(t *testing.T) {
 	directory := t.TempDir()
 	ready := filepath.Join(t.TempDir(), "descendant")