Propagate CI safety settings into nested checks

tests/test_security_audit_wrapper.py

@@ -491,9 +491,11 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase):
         *,
         scope: str,
         actions_mounts: object | None = None,
+        **environment_overrides: str,
     ) -> tuple[subprocess.CompletedProcess[str], list[list[str]]]:
         self.docker_log.write_text("", encoding="utf-8")
         environment = self.environment.copy()
+        environment.update(environment_overrides)
         if actions_mounts is None:
             environment.pop("GITEA_ACTIONS", None)
         else:
@@ -586,6 +588,67 @@ class SecurityAuditContainerRunnerTests(unittest.TestCase):
                 self.assertEqual(expected_roots, repository_roots)
                 self.assertIn("SECURITY_AUDIT_REQUIRE_TOOLS=1", run_command)
 
+    def test_gitea_job_passes_only_public_git_url_rewrites(self) -> None:
+        mounts = [
+            {
+                "Type": "volume",
+                "Name": "govoplan-actions-workspace",
+                "Destination": str(META_ROOT.parent),
+                "RW": True,
+            }
+        ]
+        git_config = {
+            "GIT_CONFIG_COUNT": "2",
+            "GIT_CONFIG_KEY_0": (
+                "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf"
+            ),
+            "GIT_CONFIG_VALUE_0": "git@git.add-ideas.de:GovOPlaN/govoplan",
+            "GIT_CONFIG_KEY_1": (
+                "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf"
+            ),
+            "GIT_CONFIG_VALUE_1": (
+                "ssh://git@git.add-ideas.de/GovOPlaN/govoplan"
+            ),
+        }
+
+        result, commands = self._run(
+            scope="govoplan",
+            actions_mounts=mounts,
+            **git_config,
+        )
+
+        self.assertEqual(0, result.returncode, result.stderr)
+        run_command = next(command for command in commands if command[0] == "run")
+        for key, value in git_config.items():
+            self.assertIn(f"{key}={value}", run_command)
+
+    def test_container_runner_rejects_non_url_git_configuration(self) -> None:
+        result, _commands = self._run(
+            scope="current",
+            GIT_CONFIG_COUNT="1",
+            GIT_CONFIG_KEY_0="credential.helper",
+            GIT_CONFIG_VALUE_0="!print-secret",
+        )
+
+        self.assertEqual(1, result.returncode)
+        self.assertIn(
+            "Only credential-free HTTPS Git insteadOf rewrites",
+            result.stderr,
+        )
+
+    def test_security_workflow_configures_nested_public_git_resolution(
+        self,
+    ) -> None:
+        workflow = (
+            META_ROOT / ".gitea" / "workflows" / "security-audit.yml"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn('GIT_CONFIG_COUNT: "2"', workflow)
+        self.assertIn(
+            "url.https://git.add-ideas.de/GovOPlaN/govoplan.insteadOf",
+            workflow,
+        )
+
     def test_non_actions_runner_keeps_the_scoped_bind_mount(self) -> None:
         result, commands = self._run(scope="govoplan")