Leave no package-registry credential or clone userinfo in the workspace a check mounts (issue 462)

A build wrote .npmrc into its source tree and never removed it, and its clone
recorded the URL's userinfo; a later check's container mounts the workspace as
HOME. The .npmrc and the tree now go when the build ends, clones record their
URL without userinfo, and a check first removes any .npmrc an older builder left.

internal/builder/check_credential_test.go

@@ -28,6 +28,7 @@ const (
 	forgeSecret  = "sw0rdfi5h-forge"
 	forgeURL     = "http://mesh_novox_builder:" + forgeSecret + "@forge.invalid:20000"
 	besideSecret = "b3side-t0ken"
+	npmSecret    = "npm-s3cret-t0ken"
 )
 
 // aFactsRegistry is an artifact store holding the facts snapshot, and nothing else.
@@ -116,7 +117,8 @@ func TestACheckContainerSeesNoForgeCredential(t *testing.T) {
 					raw, _ := os.ReadFile(path)
 					s := string(raw)
 					if strings.Contains(s, forgeSecret) || strings.Contains(s, besideSecret) ||
-						d.Name() == "git-credentials" || strings.Contains(s, "credential.helper") {
+						strings.Contains(s, npmSecret) || d.Name() == "git-credentials" || d.Name() == ".npmrc" ||
+						strings.Contains(s, "credential.helper") {
 						leaks = append(leaks, path)
 					}
 					return nil
@@ -137,10 +139,20 @@ func TestACheckContainerSeesNoForgeCredential(t *testing.T) {
 		}
 		return "", errors.New("unexpected command " + name)
 	}
-	// A credential an older builder left in the workspace is removed too.
+	// A credential an older builder left in the workspace is removed too: the forge's, and the .npmrc a
+	// build wrote into the tree it cloned.
 	if err := os.WriteFile(filepath.Join(workspace, "git-credentials"), []byte(forgeURL+"\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	for _, dir := range []string{"source/x", "context-server"} {
+		if err := os.MkdirAll(filepath.Join(workspace, dir), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(workspace, dir, ".npmrc"),
+			[]byte("//forge.invalid/api/packages/novox/npm/:_authToken="+npmSecret+"\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
 	_, err := Check(t.Context(), run, CheckSpec{ID: "check-462", Repository: repo, Ref: head, Owner: "novox",
 		Repo: "mesh-controller", Number: 1, Toolchain: "golang", Beside: map[string]Beside{
 			"mesh-catalog": {Repository: besideURL, Ref: besideHead}}}, workspace, aFactsRegistry(t),
@@ -198,3 +210,42 @@ func TestTheRedactorHidesTheForgeCredentialAndShapes(t *testing.T) {
 		}
 	}
 }
+
+// A build's clone of a URL carrying userinfo records it without, so no build leaves a credential in
+// workspace/source/.git/config while it runs either (novox/hq issue 462); the tree itself is gone when the
+// build ends.
+func TestABuildsCloneRecordsNoUserinfo(t *testing.T) {
+	repo, _ := aCheckedRepository(t, map[string]string{ManifestName: `{"module":"plain","version":"1"}`})
+	source := "file://build-user:" + besideSecret + "@" + repo
+	workspace := t.TempDir()
+	tree := filepath.Join(workspace, "source")
+	var configs []string
+	run := func(ctx context.Context, dir, name string, args ...string) (string, error) {
+		if name == "git" && hasString(args, "clone") && args[len(args)-2] == source {
+			clone := append(append([]string{}, args[:len(args)-2]...), bareURL(t, source), args[len(args)-1])
+			if out, err := Command(ctx, dir, "git", clone...); err != nil {
+				return out, err
+			}
+			return Command(ctx, args[len(args)-1], "git", "remote", "set-url", "origin", source)
+		}
+		if name == "git" && len(args) > 0 && args[0] == "rev-parse" {
+			raw, _ := os.ReadFile(filepath.Join(tree, ".git", "config"))
+			configs = append(configs, string(raw))
+		}
+		return Command(ctx, dir, name, args...)
+	}
+	if _, err := Build(t.Context(), run, &recorded{}, source, "", "", workspace, nil, Npmrc{}, GitCredential{}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if len(configs) == 0 {
+		t.Fatal("the build never read its clone")
+	}
+	for _, c := range configs {
+		if strings.Contains(c, besideSecret) || strings.Contains(c, "build-user") {
+			t.Fatalf("the build's clone records the credential it was cloned with:\n%s", c)
+		}
+	}
+	if _, err := os.Stat(tree); !os.IsNotExist(err) {
+		t.Fatalf("the build's tree outlives the build: %v", err)
+	}
+}