git 逻辑

internal/infra/git/runner_test.go

@@ -3,6 +3,7 @@ package git
 import (
 	"context"
 	"errors"
+	"os"
 	"os/exec"
 	"strings"
 	"testing"
@@ -11,6 +12,17 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// envValue 从 "K=V" 形式的 env 列表中取出 key 对应的 value。
+func envValue(env []string, key string) string {
+	prefix := key + "="
+	for _, e := range env {
+		if strings.HasPrefix(e, prefix) {
+			return strings.TrimPrefix(e, prefix)
+		}
+	}
+	return ""
+}
+
 func TestDefaultRunner_exec_BinaryNotFound(t *testing.T) {
 	t.Parallel()
 	r := NewDefaultRunner(Config{Binary: "this-is-not-a-real-binary-xyz"})
@@ -75,9 +87,21 @@ func TestCredentialEnv_PAT(t *testing.T) {
 	defer cleanup()
 	joined := strings.Join(env, "\n")
 	require.Contains(t, joined, "GIT_ASKPASS=")
-	require.Contains(t, joined, "GIT_PAT_USERNAME=alice")
-	require.Contains(t, joined, "GIT_PAT_TOKEN=tok")
 	require.Contains(t, joined, "GIT_TERMINAL_PROMPT=0")
+	// 凭据通过 0600 临时文件下发（避免出现在进程 env 中），env 仅暴露文件路径，
+	// 文件内容须等于用户名/令牌原文。
+	require.Contains(t, joined, "GIT_PAT_USERNAME_FILE=")
+	require.Contains(t, joined, "GIT_PAT_TOKEN_FILE=")
+	userFile := envValue(env, "GIT_PAT_USERNAME_FILE")
+	tokenFile := envValue(env, "GIT_PAT_TOKEN_FILE")
+	require.NotEmpty(t, userFile)
+	require.NotEmpty(t, tokenFile)
+	userData, err := os.ReadFile(userFile)
+	require.NoError(t, err)
+	require.Equal(t, "alice", string(userData))
+	tokenData, err := os.ReadFile(tokenFile)
+	require.NoError(t, err)
+	require.Equal(t, "tok", string(tokenData))
 }
 
 func TestCredentialEnv_SSHKey(t *testing.T) {