From efd1cf4ef68ebc4d39287befabd49ec048af213d Mon Sep 17 00:00:00 2001
From: Dobromir Popov <dobromir.popov@gmail.com>
Date: Fri, 17 Jul 2026 10:47:15 +0300
Subject: [PATCH] fix: support headless Gitea credentials

---
 scripts/ralph_gitea_sync.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/ralph_gitea_sync.py b/scripts/ralph_gitea_sync.py
index d181503..ef40317 100644
--- a/scripts/ralph_gitea_sync.py
+++ b/scripts/ralph_gitea_sync.py
@@ -31,6 +31,13 @@ STATUS_LABELS = {
 
 
 def credential_for(host: str) -> tuple[str, str]:
+    # Prefer explicitly injected process credentials for headless workers. They
+    # are never written to the repo or emitted in logs.
+    username = os.environ.get("GITEA_USERNAME")
+    password = os.environ.get("GITEA_TOKEN") or os.environ.get("GITEA_PASSWORD")
+    if password:
+        return username or "", password
+
     result = subprocess.run(
         ["git", "credential", "fill"],
         input=f"protocol=https\nhost={host}\n\n",