fix: provide git credentials on first attempt

[merll]

Implements a Git client configuration, similar to linode/apl-core#3590.

[Copilot]

Pull request overview

Adds Git client configuration so HTTP remotes can proactively send Basic auth credentials, aiming to avoid an initial unauthenticated request/round-trip during remote operations.

Changes:

• Configure git to use http.proactiveAuth=basic when setting up repository config.

Suppressed comments (1)

src/git.ts:56

• http.proactiveAuth=basic will proactively send Basic auth headers; combined with the current behavior where URLs without a scheme default to http (see getProtocol()), this increases the chance of sending credentials over plaintext HTTP. Consider only enabling proactive auth for https remotes (or other explicitly secure protocols).

    await this.git.addConfig('http.proactiveAuth', 'basic')

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/git.ts:182

• New behavior is introduced to force proactive HTTP Basic auth during the initial clone, but there is no unit test coverage ensuring the clone is invoked with the intended arguments/order. Adding a test would prevent regressions (especially given the subtle ordering requirements of -c).

      await this.git.clone(this.urlAuth, this.path, ['-c', 'http.proactiveAuth=basic'])