Propagate CI safety settings into nested checks

.gitea/workflows/security-audit.yml

@@ -16,6 +16,11 @@ jobs:
       SECURITY_AUDIT_SCOPE: govoplan
       SECURITY_AUDIT_FAIL_ON_FINDINGS: "0"
       SECURITY_AUDIT_REQUIRE_TOOLS: "1"
+      GIT_CONFIG_COUNT: "2"
+      GIT_CONFIG_KEY_0: url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf
+      GIT_CONFIG_VALUE_0: git@git.add-ideas.de:GovOPlaN/govoplan
+      GIT_CONFIG_KEY_1: url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf
+      GIT_CONFIG_VALUE_1: ssh://git@git.add-ideas.de/GovOPlaN/govoplan
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
@@ -23,10 +28,6 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.12"
-      - name: Use anonymous HTTPS for public GovOPlaN repositories
-        run: |
-          git config --global --add url."https://git.add-ideas.de/GovOPlaN/govoplan".insteadOf "git@git.add-ideas.de:GovOPlaN/govoplan"
-          git config --global --add url."https://git.add-ideas.de/GovOPlaN/govoplan".insteadOf "ssh://git@git.add-ideas.de/GovOPlaN/govoplan"
       - name: Bootstrap GovOPlaN repositories
         working-directory: govoplan
         run: python tools/repo/bootstrap-repositories.py --parent .. --transport public-https --exclude-repo addideas-govoplan-website

tests/test_postgres_integration_check.py

@@ -46,6 +46,10 @@ class PostgresIntegrationCheckTests(unittest.TestCase):
             env["GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS"],
             "false",
         )
+        self.assertEqual(
+            env["GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE"],
+            "true",
+        )
 
     def test_existing_runtime_safety_settings_are_preserved(self) -> None:
         module = _load_script()
@@ -53,6 +57,7 @@ class PostgresIntegrationCheckTests(unittest.TestCase):
             "CORS_ORIGINS": "https://govoplan.example.test",
             "GOVOPLAN_TRUSTED_HOSTS": "govoplan.example.test",
             "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "true",
+            "GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE": "false",
         }
 
         with patch.dict(os.environ, configured, clear=True):

tests/test_security_audit_wrapper.py

@@ -491,9 +491,11 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase):
         *,
         scope: str,
         actions_mounts: object | None = None,
+        **environment_overrides: str,
     ) -> tuple[subprocess.CompletedProcess[str], list[list[str]]]:
         self.docker_log.write_text("", encoding="utf-8")
         environment = self.environment.copy()
+        environment.update(environment_overrides)
         if actions_mounts is None:
             environment.pop("GITEA_ACTIONS", None)
         else:
@@ -586,6 +588,67 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase):
                 self.assertEqual(expected_roots, repository_roots)
                 self.assertIn("SECURITY_AUDIT_REQUIRE_TOOLS=1", run_command)
 
+    def test_gitea_job_passes_only_public_git_url_rewrites(self) -> None:
+        mounts = [
+            {
+                "Type": "volume",
+                "Name": "govoplan-actions-workspace",
+                "Destination": str(META_ROOT.parent),
+                "RW": True,
+            }
+        ]
+        git_config = {
+            "GIT_CONFIG_COUNT": "2",
+            "GIT_CONFIG_KEY_0": (
+                "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf"
+            ),
+            "GIT_CONFIG_VALUE_0": "git@git.add-ideas.de:GovOPlaN/govoplan",
+            "GIT_CONFIG_KEY_1": (
+                "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf"
+            ),
+            "GIT_CONFIG_VALUE_1": (
+                "ssh://git@git.add-ideas.de/GovOPlaN/govoplan"
+            ),
+        }
+
+        result, commands = self._run(
+            scope="govoplan",
+            actions_mounts=mounts,
+            **git_config,
+        )
+
+        self.assertEqual(0, result.returncode, result.stderr)
+        run_command = next(command for command in commands if command[0] == "run")
+        for key, value in git_config.items():
+            self.assertIn(f"{key}={value}", run_command)
+
+    def test_container_runner_rejects_non_url_git_configuration(self) -> None:
+        result, _commands = self._run(
+            scope="current",
+            GIT_CONFIG_COUNT="1",
+            GIT_CONFIG_KEY_0="credential.helper",
+            GIT_CONFIG_VALUE_0="!print-secret",
+        )
+
+        self.assertEqual(1, result.returncode)
+        self.assertIn(
+            "Only credential-free HTTPS Git insteadOf rewrites",
+            result.stderr,
+        )
+
+    def test_security_workflow_configures_nested_public_git_resolution(
+        self,
+    ) -> None:
+        workflow = (
+            META_ROOT / ".gitea" / "workflows" / "security-audit.yml"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn('GIT_CONFIG_COUNT: "2"', workflow)
+        self.assertIn(
+            "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf",
+            workflow,
+        )
+
     def test_non_actions_runner_keeps_the_scoped_bind_mount(self) -> None:
         result, commands = self._run(scope="govoplan")
 

tools/checks/postgres-integration-check.py

@@ -119,6 +119,7 @@ def _check_env(*, database_url: str, modules: str, app_env: str) -> dict[str, st
     env.setdefault("CORS_ORIGINS", "http://127.0.0.1:5173,http://localhost:5173")
     env.setdefault("GOVOPLAN_TRUSTED_HOSTS", "127.0.0.1,localhost,testserver")
     env.setdefault("GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS", "false")
+    env.setdefault("GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE", "true")
     env["PYTHONPATH"] = os.pathsep.join(part for part in (str(SRC), env.get("PYTHONPATH", "")) if part)
     return env
 

tools/checks/security-audit/run.sh

@@ -193,6 +193,39 @@ else
   EXTRA_ENV=()
 fi
 
+declare -a GIT_CONFIG_ENV=()
+GIT_CONFIG_COUNT_VALUE="${GIT_CONFIG_COUNT:-0}"
+if ! [[ "$GIT_CONFIG_COUNT_VALUE" =~ ^[0-9]+$ ]] || (( GIT_CONFIG_COUNT_VALUE > 8 )); then
+  echo "GIT_CONFIG_COUNT must be an integer between 0 and 8." >&2
+  exit 1
+fi
+for ((index = 0; index < GIT_CONFIG_COUNT_VALUE; index++)); do
+  key_name="GIT_CONFIG_KEY_$index"
+  value_name="GIT_CONFIG_VALUE_$index"
+  if ! [[ -v "$key_name" && -v "$value_name" ]]; then
+    echo "Both $key_name and $value_name are required." >&2
+    exit 1
+  fi
+  key_value="${!key_name}"
+  rewrite_value="${!value_name}"
+  target_url="${key_value#url.}"
+  target_url="${target_url%.insteadOf}"
+  if [[ "$key_value" != url.https://*.insteadOf ]] \
+    || [[ "${target_url#https://}" == *"@"* ]] \
+    || [[ "$rewrite_value" != git@* && "$rewrite_value" != ssh://git@* ]] \
+    || [[ "$key_value" == *$'\n'* || "$rewrite_value" == *$'\n'* ]]; then
+    echo "Only credential-free HTTPS Git insteadOf rewrites may enter the audit container." >&2
+    exit 1
+  fi
+  GIT_CONFIG_ENV+=(
+    -e "$key_name=$key_value"
+    -e "$value_name=$rewrite_value"
+  )
+done
+if (( GIT_CONFIG_COUNT_VALUE > 0 )); then
+  GIT_CONFIG_ENV+=(-e "GIT_CONFIG_COUNT=$GIT_CONFIG_COUNT_VALUE")
+fi
+
 "${DOCKER_CLI[@]}" run --rm \
   --user "$(id -u):$(id -g)" \
   -e HOME=/tmp/security-audit-home \
@@ -203,6 +236,7 @@ fi
   -e SECURITY_AUDIT_REQUIRE_TOOLS="$REQUIRE_TOOLS" \
   -e SECURITY_AUDIT_TOOLBOX_FINGERPRINT="$IMAGE_FINGERPRINT" \
   "${EXTRA_ENV[@]}" \
+  "${GIT_CONFIG_ENV[@]}" \
   "${WORKSPACE_MOUNT[@]}" \
   -w "$WORKDIR" \
   "$FINGERPRINT_IMAGE" \