Git authentication & identity

1. Administrator project clone injects HTTPS authentication for one invocation through http.extraHeader. The credential is absent from the clone URL and command arguments.
2. Raw Git in the PAUIOps administrator shell uses the runtime service user’s startup-seeded credential.helper=store entry when both credential values are set.
3. App-triggered commits receive user.name and user.email per invocation. Commit identity does not authenticate the remote or change global/repository author settings.

PAUIOPS_GIT_USERNAME=<git-provider-username>
PAUIOPS_GIT_PASSWORD=<scoped-provider-access-token>
PAUIOPS_GIT_HOST=<git-provider-host>
PAUIOPS_GIT_AUTHOR_NAME=PAUIOps Automation
PAUIOPS_GIT_AUTHOR_EMAIL=<git-author-email>

The host is bare: no https:// and no repository path. Startup resolves the account actually running Manager, writes or tightens its .git-credentials to 0600, URL-encodes special characters, replaces only the configured host, and adds store only when it is absent from the multi-valued global helper list.

Structured PAUIOps-owned Git runners, private clone, and the bounded helper setup remove PAUIOPS_*, deprecated DOCKER_MGR_*, and SUDO_PASSWORD before spawning Git or its hooks. A raw or interactive terminal inherits the service process environment before it invokes Git, scripts, helpers, or hooks. Treat terminal access and executable repository hooks as trusted-code boundaries.

safe.directory remains scoped to the active repository. PAUIOps never uses safe.directory=*. Structured Git prompting is disabled so missing credentials fail clearly instead of hanging.

For rotation, update PAUIOPS_GIT_PASSWORD in the protected environment and restart Manager; the same-host entry is replaced without duplicates. Clearing either variable is a no-op and does not erase the existing store entry. Changing the host also preserves the old host.

printf 'protocol=https\nhost=<old-git-host>\n\n' \
  | sudo -u <service-user> -H git credential reject