Propagate CI safety settings into nested checks

tools/checks/postgres-integration-check.py

@@ -119,6 +119,7 @@ def _check_env(*, database_url: str, modules: str, app_env: str) -> dict[str, st
     env.setdefault("CORS_ORIGINS", "http://127.0.0.1:5173,http://localhost:5173")
     env.setdefault("GOVOPLAN_TRUSTED_HOSTS", "127.0.0.1,localhost,testserver")
     env.setdefault("GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS", "false")
+    env.setdefault("GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE", "true")
     env["PYTHONPATH"] = os.pathsep.join(part for part in (str(SRC), env.get("PYTHONPATH", "")) if part)
     return env
 

tools/checks/security-audit/run.sh

@@ -193,6 +193,39 @@ else
   EXTRA_ENV=()
 fi
 
+declare -a GIT_CONFIG_ENV=()
+GIT_CONFIG_COUNT_VALUE="${GIT_CONFIG_COUNT:-0}"
+if ! [[ "$GIT_CONFIG_COUNT_VALUE" =~ ^[0-9]+$ ]] || (( GIT_CONFIG_COUNT_VALUE > 8 )); then
+  echo "GIT_CONFIG_COUNT must be an integer between 0 and 8." >&2
+  exit 1
+fi
+for ((index = 0; index < GIT_CONFIG_COUNT_VALUE; index++)); do
+  key_name="GIT_CONFIG_KEY_$index"
+  value_name="GIT_CONFIG_VALUE_$index"
+  if ! [[ -v "$key_name" && -v "$value_name" ]]; then
+    echo "Both $key_name and $value_name are required." >&2
+    exit 1
+  fi
+  key_value="${!key_name}"
+  rewrite_value="${!value_name}"
+  target_url="${key_value#url.}"
+  target_url="${target_url%.insteadOf}"
+  if [[ "$key_value" != url.https://*.insteadOf ]] \
+    || [[ "${target_url#https://}" == *"@"* ]] \
+    || [[ "$rewrite_value" != git@* && "$rewrite_value" != ssh://git@* ]] \
+    || [[ "$key_value" == *$'\n'* || "$rewrite_value" == *$'\n'* ]]; then
+    echo "Only credential-free HTTPS Git insteadOf rewrites may enter the audit container." >&2
+    exit 1
+  fi
+  GIT_CONFIG_ENV+=(
+    -e "$key_name=$key_value"
+    -e "$value_name=$rewrite_value"
+  )
+done
+if (( GIT_CONFIG_COUNT_VALUE > 0 )); then
+  GIT_CONFIG_ENV+=(-e "GIT_CONFIG_COUNT=$GIT_CONFIG_COUNT_VALUE")
+fi
+
 "${DOCKER_CLI[@]}" run --rm \
   --user "$(id -u):$(id -g)" \
   -e HOME=/tmp/security-audit-home \
@@ -203,6 +236,7 @@ fi
   -e SECURITY_AUDIT_REQUIRE_TOOLS="$REQUIRE_TOOLS" \
   -e SECURITY_AUDIT_TOOLBOX_FINGERPRINT="$IMAGE_FINGERPRINT" \
   "${EXTRA_ENV[@]}" \
+  "${GIT_CONFIG_ENV[@]}" \
   "${WORKSPACE_MOUNT[@]}" \
   -w "$WORKDIR" \
   "$FINGERPRINT_IMAGE" \