From 1b7e67d1f93e55fd36ca05a48c4f86885cda23e9 Mon Sep 17 00:00:00 2001
From: Valentin Maerten <maerten.valentin@gmail.com>
Date: Thu, 20 Aug 2026 18:12:26 +0200
Subject: [PATCH] refactor(remote): carry the auth headers as
 taskfile.HostHeaders

map[string]map[string]string named neither key. The type already existed
in taskfile; package task reaches it through setup.go, so only an import
was missing. Callers keep passing a plain map literal, which stays
assignable to a named map type.
---
 executor.go             | 7 ++++---
 internal/flags/flags.go | 7 ++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/executor.go b/executor.go
index 5bd3857c..49a367ee 100644
--- a/executor.go
+++ b/executor.go
@@ -13,6 +13,7 @@ import (
 	"github.com/go-task/task/v3/internal/logger"
 	"github.com/go-task/task/v3/internal/output"
 	"github.com/go-task/task/v3/internal/sort"
+	"github.com/go-task/task/v3/taskfile"
 	"github.com/go-task/task/v3/taskfile/ast"
 )
 
@@ -36,7 +37,7 @@ type (
 		Download            bool
 		Offline             bool
 		TrustedHosts        []string
-		RemoteAuth          map[string]map[string]string
+		RemoteAuth          taskfile.HostHeaders
 		Timeout             time.Duration
 		CacheExpiryDuration time.Duration
 		RemoteCacheDir      string
@@ -280,12 +281,12 @@ func (o *trustedHostsOption) ApplyToExecutor(e *Executor) {
 
 // WithRemoteAuth configures the [Executor] with the HTTP headers to send when
 // fetching a remote Taskfile, keyed by host.
-func WithRemoteAuth(remoteAuth map[string]map[string]string) ExecutorOption {
+func WithRemoteAuth(remoteAuth taskfile.HostHeaders) ExecutorOption {
 	return &remoteAuthOption{remoteAuth}
 }
 
 type remoteAuthOption struct {
-	remoteAuth map[string]map[string]string
+	remoteAuth taskfile.HostHeaders
 }
 
 func (o *remoteAuthOption) ApplyToExecutor(e *Executor) {
diff --git a/internal/flags/flags.go b/internal/flags/flags.go
index 1a3a791e..a6b249b5 100644
--- a/internal/flags/flags.go
+++ b/internal/flags/flags.go
@@ -16,6 +16,7 @@ import (
 	"github.com/go-task/task/v3/experiments"
 	"github.com/go-task/task/v3/internal/env"
 	"github.com/go-task/task/v3/internal/sort"
+	"github.com/go-task/task/v3/taskfile"
 	"github.com/go-task/task/v3/taskfile/ast"
 	"github.com/go-task/task/v3/taskrc"
 	taskrcast "github.com/go-task/task/v3/taskrc/ast"
@@ -79,7 +80,7 @@ var (
 	Download            bool
 	Offline             bool
 	TrustedHosts        []string
-	RemoteAuth          map[string]map[string]string
+	RemoteAuth          taskfile.HostHeaders
 	ClearCache          bool
 	Timeout             time.Duration
 	CacheExpiryDuration time.Duration
@@ -317,11 +318,11 @@ func (o *flagsOption) ApplyToExecutor(e *task.Executor) {
 
 // remoteAuth flattens the configured entries into a lookup by host, the last
 // entry winning as it does when configuration files are merged.
-func remoteAuth(config *taskrcast.TaskRC) map[string]map[string]string {
+func remoteAuth(config *taskrcast.TaskRC) taskfile.HostHeaders {
 	if config == nil || len(config.Remote.Auth) == 0 {
 		return nil
 	}
-	byHost := make(map[string]map[string]string, len(config.Remote.Auth))
+	byHost := make(taskfile.HostHeaders, len(config.Remote.Auth))
 	for _, auth := range config.Remote.Auth {
 		byHost[auth.Host] = auth.Headers
 	}