feat(git): insteadOf environment variables for authentication

[Shegox]

Changes:

This PR uses the newly in git 2.31 introduced environment variables for authentication for go module updates (e.g. sum files).
The current change only replaces the existing functionality and provides a generic function to get authentication environment variables for git via getGitAuthenticatedEnvironmentVariables(gitUrl, token, environmentVariables).

Requires git cli >=2.31 to use GIT_CONFIG_ variables to provide the credentials as environment variables to the go get process, which then invokes git underneath.

Happy about any feedback :)

Context:

Fixes #11060

Part of enabling authenticated go module updates #7361

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

BTW: git v2.31.0 is from march 2021. so we should add a hint for self-hosted users.

renovate/docs/development/local-development.md

Line 13 in 8fac1fd

- Git

renovate/docs/usage/self-hosting.md

Line 1 in 36d37b3

# Self-Hosting Renovate

[rarkins]

I tried adding a git version detection previously and had to give up. Surely shouldn't be too hard. Maybe we could try with v26 and have an option to skip detection if it fails?

[Shegox]

Yes, that could be an option. The worst happening is that git ignores the environment variables. Meaning that just the authentication forgo get -d fails, everything else keeps on working as currently.
But yeah it makes sense to at least log an error/warning message if it isn't supported.

[viceice]

I tried adding a git version detection previously and had to give up. Surely shouldn't be too hard. Maybe we could try with v26 and have an option to skip detection if it fails?

I know, it's on my to-do list. Will check what's going wrong on your branch.

[rarkins]

Yes, that could be an option. The worst happening is that git ignores the environment variables. Meaning that just the authentication forgo get -d fails, everything else keeps on working as currently.
But yeah it makes sense to at least log an error/warning message if it isn't supported.

Because the failure is therefore graceful, I'm ok with merging this without adding logic to check/warn about git, because that's not for go modules only.

However if Go Modules auth was working before with a certain version of git but then stop working in a newer version of Renovate, I think that's probably best to go into v26 as a breaking change so that it's less likely to be missed.

[Shegox]

@rarkins and @viceice I took the time to rebase my changes.
Since nowadays git >=2.33 is anyway required this (requiring git >=2.31) should no longer be a breaking change and good to be reviewed.

[viceice]

Please use re-request review buttons when you like to have a new review 😉

[renovate-release]

🎉 This PR is included in version 28.3.0 🎉

The release is available on:

• GitHub release
• 28.3.0

Your semantic-release bot 📦🚀