From 2a7b9f4a1d4b8b6109d8514b90b8eb63f427c428 Mon Sep 17 00:00:00 2001
From: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:08:29 +0200
Subject: [PATCH 1/2] Add credential_hosts source param to scope HTTP(S)
 credentials

Refs #482. When set, username/password are written to .netrc as
machine-scoped entries for the listed hosts instead of the default
entry, which matches every host and so sends the credentials to any
host a submodule URL points at. Omitting the param keeps the previous
behavior. Uses the same machine-scoping mechanism submodule_credentials
already uses.

Signed-off-by: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
---
 README.md                 |  4 ++++
 assets/common.sh          |  9 ++++++++-
 assets/source_schema.json |  1 +
 test/check.sh             | 26 ++++++++++++++++++++++++++
 test/helpers.sh           | 11 +++++++++++
 5 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4a990388..a6a273f6 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,10 @@ private_key: |
     <td><code>password</code> (Optional)</td>
     <td>Password for HTTP(S) auth when pulling/pushing.</td>
   </tr>
+  <tr>
+    <td><code>credential_hosts</code> (Optional)</td>
+    <td>List of hostnames the HTTP(S) <code>username</code>/<code>password</code> may be sent to. When set, the credentials are written to <code>.netrc</code> scoped to these hosts instead of the <code>default</code> entry, which matches every host. Hosts are specified with no protocol, e.g. <code>github.com</code>. Submodules on hosts not listed here will not receive these credentials; use <code>submodule_credentials</code> for those. When omitted, credentials match all hosts (previous behavior).</td>
+  </tr>
   <tr>
     <td><code>skip_ssl_verification</code> (Optional)</td>
     <td>Skips git ssl verification by exporting <code>GIT_SSL_NO_VERIFY=true</code>.</td>
diff --git a/assets/common.sh b/assets/common.sh
index 6a2faccb..21f5dbca 100644
--- a/assets/common.sh
+++ b/assets/common.sh
@@ -282,7 +282,14 @@ configure_credentials() {
   configure_submodule_credentials "$1"
 
   if [ "$username" != "" -a "$password" != "" ]; then
-    echo "default login $username password $password" >> "${HOME}/.netrc"
+    local credential_hosts=$(jq -r '.source.credential_hosts // [] | .[]' <<< "$1")
+    if [ "$credential_hosts" != "" ]; then
+      for host in $credential_hosts; do
+        echo "machine $host login $username password $password" >> "${HOME}/.netrc"
+      done
+    else
+      echo "default login $username password $password" >> "${HOME}/.netrc"
+    fi
   fi
 }
 
diff --git a/assets/source_schema.json b/assets/source_schema.json
index b9fa8775..36964c81 100644
--- a/assets/source_schema.json
+++ b/assets/source_schema.json
@@ -8,6 +8,7 @@
   "forward_agent": "",
   "username": "",
   "password": "",
+  "credential_hosts": "",
   "paths": "",
   "sparse_paths": "",
   "ignore_paths": "",
diff --git a/test/check.sh b/test/check.sh
index 04df6677..64fcd7a3 100755
--- a/test/check.sh
+++ b/test/check.sh
@@ -168,6 +168,31 @@ EOF
   [ ! -f "$HOME/.netrc" ]
 }
 
+it_scopes_credentials_to_credential_hosts() {
+  local repo=$(init_repo)
+  local ref=$(make_commit "$repo")
+  local expected_netrc
+  expected_netrc=$(cat <<EOF
+machine host1 login user1 password pass1
+machine host2 login user1 password pass1
+EOF
+)
+  check_uri_with_credential_hosts "$repo" "user1" "pass1" "host1 host2" | jq -e "
+    . == [{ref: $(echo $ref | jq -R .)}]
+  "
+  echo "Generated netrc $(cat ${HOME}/.netrc)"
+  echo "Expected netrc $expected_netrc"
+  [ "$(cat $HOME/.netrc)" = "$expected_netrc" ]
+
+  # no default entry: the credentials must not match hosts outside the list
+  ! grep -q "^default " $HOME/.netrc
+
+  check_uri_with_credentials $repo "" "" | jq -e "
+    . == [{ref: $(echo $ref | jq -R .)}]
+  "
+  [ ! -f "$HOME/.netrc" ]
+}
+
 it_clears_netrc_even_after_errors() {
   local repo=$(init_repo)
   local ref=$(make_commit $repo)
@@ -1190,6 +1215,7 @@ run it_configures_forward_agent
 run it_skips_forward_agent_configuration
 run it_can_check_with_credentials
 run it_can_check_with_submodule_credentials
+run it_scopes_credentials_to_credential_hosts
 run it_clears_netrc_even_after_errors
 run it_can_check_empty_commits
 run it_can_check_with_tag_filter
diff --git a/test/helpers.sh b/test/helpers.sh
index 47c16e9d..053fc3a8 100644
--- a/test/helpers.sh
+++ b/test/helpers.sh
@@ -408,6 +408,17 @@ check_uri_with_submodule_credentials() {
   }" | ${resource_dir}/check | tee /dev/stderr
 }
 
+check_uri_with_credential_hosts() {
+  jq -n "{
+    source: {
+      uri: $(echo $1 | jq -R .),
+      username: $(echo $2 | jq -R .),
+      password: $(echo $3 | jq -R .),
+      credential_hosts: $(echo "$4" | jq -R '. | split(" ")')
+    }
+  }" | ${resource_dir}/check | tee /dev/stderr
+}
+
 check_uri_ignoring() {
   local uri=$1
 

From bb1e5dcfc0c0ad9f328bdf7d1fdc6cca8efb8107 Mon Sep 17 00:00:00 2001
From: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:08:42 +0200
Subject: [PATCH 2/2] credential_hosts: tolerate string form, not just arrays

A bare string (credential_hosts: "host1") previously failed the jq
iteration, and because 'local' masks the exit code the function fell
through to writing the default netrc entry - silently unscoping the
credentials the user meant to restrict. Accept a string (single or
space-separated, matching the ignore_paths convention) as well as a
list.

Signed-off-by: hiddingtrojans <107155157+hiddingtrojans@users.noreply.github.com>
---
 assets/common.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/assets/common.sh b/assets/common.sh
index 21f5dbca..38f9a060 100644
--- a/assets/common.sh
+++ b/assets/common.sh
@@ -282,7 +282,7 @@ configure_credentials() {
   configure_submodule_credentials "$1"
 
   if [ "$username" != "" -a "$password" != "" ]; then
-    local credential_hosts=$(jq -r '.source.credential_hosts // [] | .[]' <<< "$1")
+    local credential_hosts=$(jq -r '(.source.credential_hosts // []) | if type == "array" then .[] else . end' <<< "$1")
     if [ "$credential_hosts" != "" ]; then
       for host in $credential_hosts; do
         echo "machine $host login $username password $password" >> "${HOME}/.netrc"