I Stopped Embedding the Token in the Remote URL. An Old Clone's .git/config Had It Sitting There, Readable by Anyone

$ B64=$(printf 'x-access-token:%s' "$TOK" | base64 -w0)
$ git remote set-url origin https://github.com/masakihirokawa/antigravitylab.net.git
$ git -c http.extraheader="Authorization: basic $B64" fetch origin main
From https://github.com/masakihirokawa/antigravitylab.net
 * branch            main       -> FETCH_HEAD
fetch_exit=0          # took 0.487 s
 
$ git -c http.extraheader="Authorization: basic bad" fetch origin main
fatal: unable to access '...': The requested URL returned error: 400
$ grep -c 'ghp_\|github_pat_' .git/config
0

#!/usr/bin/env bash
# repo_owner_preflight.sh <repo-path> <clone-url-without-token> [fallback-root]
# Decide, before writing anything, whether an existing clone may be reused.
# Exit code: 0=usable as is / 10=owned by someone else, clone into fallback / 20=broken, recreate
set -u
REPO="${1:?repo path}"; URL="${2:?url}"; FALLBACK="${3:-$HOME/repos}"
ME=$(id -u)
 
if [ ! -d "$REPO/.git" ]; then
  echo "NOCLONE $REPO"; exit 20
fi
 
OWNER=$(stat -c '%u' "$REPO/.git")
if [ "$OWNER" != "$ME" ]; then
  # safe.directory silences git's refusal but does not make the dir writable. Split the cases here
  echo "FOREIGN owner_uid=$OWNER me=$ME -> use $FALLBACK/$(basename "$REPO")"
  exit 10
fi
 
# Even if it is mine, a locked config makes the remote swap fail
if [ ! -w "$REPO/.git/config" ] || [ -e "$REPO/.git/index.lock" ]; then
  echo "LOCKED $REPO/.git (config writable=$([ -w "$REPO/.git/config" ] && echo y || echo n))"
  exit 20
fi
 
# Reject a clone silently pointing at another repository (credentials stripped from compare and display)
NOW=$(git -C "$REPO" remote get-url origin 2>/dev/null | sed -E 's#//[^@/]+@#//#')
WANT=$(echo "$URL" | sed -E 's#//[^@/]+@#//#')
[ "$NOW" = "$WANT" ] || { echo "REMOTE_MISMATCH now=$NOW want=$WANT"; exit 20; }
echo "OK $REPO"; exit 0

#!/usr/bin/env bash
# sync_repo.sh <owner/name> <preferred-dir>   (the token is read from the GH_TOKEN environment variable)
set -euo pipefail
NAME="${1:?owner/name}"; PREFERRED="${2:?preferred dir}"
URL="https://github.com/${NAME}.git"
AUTH="Authorization: basic $(printf 'x-access-token:%s' "${GH_TOKEN:?GH_TOKEN is empty}" | base64 -w0)"
HERE="$(dirname "$0")"
 
set +e
"$HERE/repo_owner_preflight.sh" "$PREFERRED" "$URL" "$HOME/repos"
RC=$?
set -e
 
case "$RC" in
  0)  DIR="$PREFERRED" ;;
  10) DIR="$HOME/repos/$(basename "$PREFERRED")" ;;   # owned by someone else: don't touch it, go to my own area
  *)  if [ ! -d "$PREFERRED/.git" ]; then DIR="$PREFERRED"      # just doesn't exist yet: create it there
      else DIR="$HOME/repos/$(basename "$PREFERRED")"; rm -rf "$DIR"; fi ;;   # broken: recreate in my own area
esac
 
umask 077                                  # keep the .git/config we create unreadable by others
mkdir -p "$(dirname "$DIR")"
if [ -d "$DIR/.git" ] && [ "$(stat -c '%u' "$DIR/.git")" = "$(id -u)" ]; then
  git -C "$DIR" remote set-url origin "$URL"            # drop any credential embedded earlier
  git -C "$DIR" -c http.extraheader="$AUTH" fetch --depth 1 origin main
  git -C "$DIR" reset --hard origin/main -q
else
  git -c http.extraheader="$AUTH" clone --depth 1 --branch main "$URL" "$DIR"
fi
chmod 600 "$DIR/.git/config"                 # tighten permissions on existing clones too
echo "READY $DIR (preflight rc=$RC)"

$ stat -c '%a' $HOME/repos/antigravitylab.net/.git/config
600
$ grep -c 'ghp_\|github_pat_' $HOME/repos/antigravitylab.net/.git/config
0