From facf11a8c7d8897f08058889aebbfbd9980b290c Mon Sep 17 00:00:00 2001
From: Rodrigo Silva Mendoza <xvandish@users.noreply.github.com>
Date: Mon, 1 Jul 2024 18:05:45 -0400
Subject: [PATCH] fetch and clone now use git config url to be able to be
 cloned/fetched

by GitHub app installation tokens.
---
 cmd/zoekt-indexserver/fetch.go  | 17 +++++++++++++----
 cmd/zoekt-mirror-github/main.go | 20 +++++++++++++++++---
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/cmd/zoekt-indexserver/fetch.go b/cmd/zoekt-indexserver/fetch.go
index 3cc139c42..cd3b4d7eb 100644
--- a/cmd/zoekt-indexserver/fetch.go
+++ b/cmd/zoekt-indexserver/fetch.go
@@ -239,11 +239,20 @@ func gitFetchNeededRepos(repoDir, indexDir string, opts *Options, pendingRepos c
 			log.Fatal(err)
 		}
 
-		log.Printf("set GITHUB_TOKEN with length=%d\n", len(ghToken))
-		os.Setenv("GITHUB_TOKEN", ghToken)
+		log.Printf("setting global git config token url replacement len=%d\n", len(ghToken))
+		gitUrlReplacement := fmt.Sprintf("url.https://x-access-token:%s@github.com/.insteadof", ghToken)
+		_, err = exec.Command("git", "config", "--global", gitUrlReplacement, "https://github.com/").Output()
+		if err != nil {
+			log.Fatal(err)
+		}
 
-		// remove the token once we're done
-		defer os.Setenv("GITHUB_TOKEN", "")
+		defer func() {
+			log.Printf("unsetting global git config token url replacement\n")
+			_, err := exec.Command("git", "config", "--global", "--unset", gitUrlReplacement, "https://github.com/").Output()
+			if err != nil {
+				log.Fatal(err)
+			}
+		}()
 	}
 
 	g, _ := errgroup.WithContext(context.Background())
diff --git a/cmd/zoekt-mirror-github/main.go b/cmd/zoekt-mirror-github/main.go
index c8dbc43db..ad728a7df 100644
--- a/cmd/zoekt-mirror-github/main.go
+++ b/cmd/zoekt-mirror-github/main.go
@@ -26,6 +26,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -161,9 +162,22 @@ func main() {
 			log.Fatal(err)
 		}
 
-		log.Printf("set GITHUB_TOKEN with length=%d\n", len(appInstallToken))
-		os.Setenv("GITHUB_TOKEN", appInstallToken)
-		defer os.Setenv("GITHUB_TOKEN", "")
+		// we set this globally rather than just munging the cloneUrl later so that
+		// the clone URL (that now includes the token) is not logged anywhere
+		log.Printf("setting global git config token url replacement len=%d\n", len(appInstallToken))
+		gitUrlReplacement := fmt.Sprintf("url.https://x-access-token:%s@github.com/.insteadof", appInstallToken)
+		_, err = exec.Command("git", "config", "--global", gitUrlReplacement, "https://github.com/").Output()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		defer func() {
+			log.Printf("unsetting global git config token url replacement\n")
+			_, err := exec.Command("git", "config", "--global", "--unset", gitUrlReplacement, "https://github.com/").Output()
+			if err != nil {
+				log.Fatal(err)
+			}
+		}()
 	}
 
 	reposFilters := reposFilters{