From 9b453e5bb6b951f362fd6625480a75a97298aa5d Mon Sep 17 00:00:00 2001
From: b3nw <b3nw@duck.com>
Date: Sat, 25 Apr 2026 01:03:42 +0000
Subject: [PATCH] fix(ci): use .netrc for HTTPS git auth instead of
 URL-embedded token

---
 Dockerfile | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 5acb615..ce4dc84 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,8 +8,10 @@ WORKDIR /app
 
 ARG GIT_TOKEN=""
 RUN if [ -n "$GIT_TOKEN" ]; then \
-      git config --global url."https://b3nw:${GIT_TOKEN}@gitea.ext.ben.io/".insteadOf "ssh://gitea@git.local.ben.io/" && \
-      git config --global --add url."https://b3nw:${GIT_TOKEN}@gitea.ext.ben.io/".insteadOf "ssh://git.local.ben.io/"; \
+      git config --global url."https://gitea.ext.ben.io/".insteadOf "ssh://gitea@git.local.ben.io/" && \
+      git config --global --add url."https://gitea.ext.ben.io/".insteadOf "ssh://git.local.ben.io/" && \
+      echo "machine gitea.ext.ben.io login b3nw password ${GIT_TOKEN}" > /root/.netrc && \
+      chmod 600 /root/.netrc; \
     fi
 
 COPY pyproject.toml uv.lock ./