Propagate workspace HTTPS Git credentials

server/services/dockerWorkspaceRuntime.ts

@@ -655,6 +655,7 @@ export class DockerWorkspaceRuntime {
         ...workspaceNodeResources(),
         '--tmpfs', '/tmp:rw,nosuid,nodev,size=536870912,uid=10001,gid=10001',
         ...commonMounts,
+        ...gitEnvironment,
         '--env', `ROKCET_NODE_URL=${spec.nodes.workspace.url}`,
         '--env', `ROKCET_NODE_REGISTRATION_CREDENTIAL=${spec.nodes.workspace.credential}`,
         '--env', 'ROKCET_NODE_ROLE=workspace',

server/services/workspaceGit.ts

@@ -9,9 +9,25 @@ const SESSION_BRANCH = /^rokcet\/session\/[0-9a-f-]{20,64}$/i;
 const FORBIDDEN_SEGMENTS = new Set(['.git', '.env', 'node_modules']);
 
 async function gitOutput(root: string, args: string[], timeout = 60_000): Promise<string> {
+  const gitConfigEnv: Record<string, string> = {};
+  const gitConfigCount = Number(process.env.GIT_CONFIG_COUNT || 0);
+  if (Number.isInteger(gitConfigCount) && gitConfigCount > 0 && gitConfigCount <= 16) {
+    gitConfigEnv.GIT_CONFIG_COUNT = String(gitConfigCount);
+    for (let i = 0; i < gitConfigCount; i += 1) {
+      const keyName = `GIT_CONFIG_KEY_${i}`;
+      const valueName = `GIT_CONFIG_VALUE_${i}`;
+      const key = process.env[keyName];
+      const value = process.env[valueName];
+      if (key && typeof value === 'string') {
+        gitConfigEnv[keyName] = key;
+        gitConfigEnv[valueName] = value;
+      }
+    }
+  }
   const { stdout } = await execFileAsync('git', ['-c', 'core.hooksPath=/dev/null', ...args], {
     cwd: root, timeout, maxBuffer: 4 * 1024 * 1024,
     env: {
+      ...gitConfigEnv,
       PATH: process.env.PATH, HOME: process.env.HOME,
       GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_TERMINAL_PROMPT: '0',
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND, LANG: 'C', LC_ALL: 'C',