#!/bin/bash
# Configure git to use git credential helper for gitea.oreillyit.nz via HTTPS.
#
# The token is read from /run/agent/secrets/gitea-https/token at every git
# invocation (not at init time). This avoids the token appearing in logs.

set -euo pipefail

CRED_HELPER="/opt/harness/contexts/gitea-https/v1/git-credential-gitea.sh"

# Create the credential helper script
cat > "$CRED_HELPER" << 'HELPER_EOF'
#!/bin/bash
# Git credential helper that provides the token from a mounted file
# for gitea.oreillyit.nz.
# This reads the file at EVERY git invocation, not at init time.
set -euo pipefail
SECRET_FILE=/run/agent/secrets/gitea-https/token
[ -r "$SECRET_FILE" ] || exit 1
echo "protocol=https"
echo "host=gitea.oreillyit.nz"
echo "username=token"
echo "password=$(cat $SECRET_FILE)"
HELPER_EOF

chmod +x "$CRED_HELPER"

# Configure git to use this credential helper for gitea.oreillyit.nz
git config --global credential.https://gitea.oreillyit.nz.helper "$CRED_HELPER"

echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"