fix: harden phase auth and failure handling

phase9_teardown.sh

@@ -20,12 +20,38 @@ log_warn "=== Phase 9 Teardown: Security Scanning ==="
 
 REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
 TEMP_BASE="/tmp/gitea-migration-security-teardown"
+GITEA_BASE_URL="${GITEA_INTERNAL_URL%/}"
+ASKPASS_SCRIPT=""
 
 cleanup() {
   rm -rf "$TEMP_BASE"
+  if [[ -n "$ASKPASS_SCRIPT" ]]; then
+    rm -f "$ASKPASS_SCRIPT"
+  fi
 }
 trap cleanup EXIT
 
+setup_git_auth() {
+  ASKPASS_SCRIPT=$(mktemp)
+  cat > "$ASKPASS_SCRIPT" <<'EOF'
+#!/usr/bin/env sh
+case "$1" in
+  *sername*) printf '%s\n' "$GITEA_GIT_USERNAME" ;;
+  *assword*) printf '%s\n' "$GITEA_GIT_TOKEN" ;;
+  *) printf '\n' ;;
+esac
+EOF
+  chmod 700 "$ASKPASS_SCRIPT"
+}
+
+git_with_auth() {
+  GIT_TERMINAL_PROMPT=0 \
+  GIT_ASKPASS="$ASKPASS_SCRIPT" \
+  GITEA_GIT_USERNAME="$GITEA_ADMIN_USER" \
+  GITEA_GIT_TOKEN="$GITEA_ADMIN_TOKEN" \
+  "$@"
+}
+
 printf 'This will remove security-scan.yml from all repos. Continue? [y/N] '
 read -r confirm
 if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
@@ -33,6 +59,8 @@ if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
   exit 0
 fi
 
+setup_git_auth
+
 for repo in "${REPOS[@]}"; do
   log_info "--- Processing: ${repo} ---"
 
@@ -46,8 +74,8 @@ for repo in "${REPOS[@]}"; do
   CLONE_DIR="${TEMP_BASE}/${repo}"
   rm -rf "$CLONE_DIR"
 
-  CLONE_URL="${GITEA_INTERNAL_URL%%://*}://${GITEA_ADMIN_USER}:${GITEA_ADMIN_TOKEN}@${GITEA_INTERNAL_URL#*://}"
-  git clone -q "${CLONE_URL}/${GITEA_ORG_NAME}/${repo}.git" "$CLONE_DIR"
+  REPO_URL="${GITEA_BASE_URL}/${GITEA_ORG_NAME}/${repo}.git"
+  git_with_auth git clone -q "$REPO_URL" "$CLONE_DIR"
 
   if [[ -f "${CLONE_DIR}/.gitea/workflows/security-scan.yml" ]]; then
     rm -f "${CLONE_DIR}/.gitea/workflows/security-scan.yml"
@@ -56,7 +84,7 @@ for repo in "${REPOS[@]}"; do
     git config user.email "migration@gitea.local"
     git add -A
     git commit -q -m "Remove security scanning workflow (teardown)"
-    git push -q origin HEAD
+    git_with_auth git push -q origin HEAD
     cd "$SCRIPT_DIR"
     log_success "Removed security-scan.yml from ${repo}"
   fi