Keep the forge credential out of what a check's container sees, and redact what a check publishes (issue 462)

The toolchain container mounts the workspace as HOME, so the credential kept
there, and a clone's recorded userinfo, were readable by any pull request; its
output is kept on the bus for days. The credential now lives in a private
directory outside the workspace only while cloning, clones record their URL
without userinfo, and every line said to the build's log and the verdict
passes a redactor copied from the journal tool (sharing it: issue 471).

internal/builder/check.go

@@ -229,7 +229,13 @@ func ScriptToolchain(script []byte) string {
 // Check runs one merge check. An error is that it could not run; the verdict is then "error".
 func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry string, forge GitCredential,
 	log Log) (CheckVerdict, error) {
-	say := logging(log)
+	// Everything a check says goes to the build's log, which the bus keeps: said redacted (novox/hq issue 462).
+	redact := redactorFor(forge)
+	say := logging(func(step, message string) {
+		if log != nil {
+			log(step, redact.redact(message))
+		}
+	})
 	began := time.Now()
 	ctx, stop := context.WithTimeout(ctx, CheckTimeout)
 	defer stop()
@@ -242,20 +248,27 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		return CheckVerdict{}, err
 	}
 	defer os.RemoveAll(root)
-	credentials := ""
-	if forge.URL != "" {
-		credentials = filepath.Join(workspace, "git-credentials")
-		if err := os.WriteFile(credentials, []byte(forge.URL+"\n"), 0o600); err != nil {
-			return CheckVerdict{}, err
-		}
+	// The forge credential lives outside the workspace the check's containers mount, and only while the
+	// check clones (novox/hq issue 462).
+	credentials, forget, err := storeCredential(workspace, forge)
+	if err != nil {
+		return CheckVerdict{}, err
 	}
+	defer forget()
 	clone := func(repository, ref, dir string) error {
 		if _, err := run(ctx, root, "git", cloneWith(credentials, "clone", "--quiet", repository, dir)...); err != nil {
-			return fmt.Errorf("cannot clone %s: %w", repository, err)
+			return fmt.Errorf("cannot clone %s: %s", redact.redact(repository), redact.redact(err.Error()))
+		}
+		// Git records the URL cloned from as given, in the clone's .git/config the container reads: one
+		// carrying userinfo is recorded without it (novox/hq issue 462).
+		if bare, ok := withoutUserinfo(repository); ok {
+			if _, err := run(ctx, filepath.Join(root, dir), "git", "remote", "set-url", "origin", bare); err != nil {
+				return fmt.Errorf("the clone of %s keeps its credential: %w", bare, err)
+			}
 		}
 		if ref != "" {
 			if _, err := run(ctx, filepath.Join(root, dir), "git", "checkout", "--quiet", ref); err != nil {
-				return fmt.Errorf("%s has no %s: %w", repository, ref, err)
+				return fmt.Errorf("%s has no %s: %w", redact.redact(repository), ref, err)
 			}
 		}
 		return nil
@@ -323,6 +336,9 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		}
 	}
 
+	// Every clone is made: the credential is gone before anything of the check runs (novox/hq issue 462).
+	forget()
+
 	// The facts, and the versions they say the mesh runs.
 	if registry == "" {
 		return CheckVerdict{}, errors.New("no artifact store to read the facts snapshot from")
@@ -479,8 +495,11 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		}
 	}
 
+	// What the check printed travels in the verdict to the forge and the controller: redacted as the log is.
+	v.Gate.Summary, v.Repo.Summary, v.Repo.Failed = redact.redact(v.Gate.Summary), redact.redact(v.Repo.Summary),
+		redact.redact(v.Repo.Failed)
 	v.Verdict, v.Summary = v.Gate.Verdict, v.Gate.Summary
-	v.Report, v.Took = withWhatFailed(out.String(), v.Repo), time.Since(began)
+	v.Report, v.Took = redact.redact(withWhatFailed(out.String(), v.Repo)), time.Since(began)
 	say("check", "gate %s — %s; repository %s — %s (%s)", strings.ToUpper(v.Gate.Verdict), v.Gate.Summary,
 		strings.ToUpper(v.Repo.Verdict), v.Repo.Summary, v.Took.Round(time.Second))
 	return v, nil
@@ -606,7 +625,9 @@ func (l *toTheLog) line(line string) {
 		line = line[:logLineBytes] + fmt.Sprintf(" … (%d bytes more)", len(line)-logLineBytes)
 	}
 	l.said++
-	l.say("output", "%s", line)
+	// Redacted by its shape before the bus keeps it (novox/hq issue 462); Check's own say adds the secrets
+	// the builder knows.
+	l.say("output", "%s", redactor{}.redact(line))
 }
 
 // close says the last line, and, when lines were left out, how many and what failed.
@@ -624,7 +645,7 @@ func (l *toTheLog) close(failed string) {
 	}
 	l.say("output", "--- what failed, picked from the whole of its output")
 	for _, line := range strings.Split(failed, "\n") {
-		l.say("output", "%s", line)
+		l.say("output", "%s", redactor{}.redact(line))
 	}
 }