RemoteExists treated every non-200 as an absent file, so a server
refusing the credentials ended up as "No Taskfile found", sending the
user to check the URL rather than the token. A 401 now stops the search
and reports the status code; the default names need the same credentials,
so trying them would only add rejected requests. A 403 is left alone: it
is also what a server without directory listing answers for a readable
directory.
That message being correct, the expansion no longer needs to refuse an
undefined variable: os.ExpandEnv is inlined and expandEnv is gone. The
`$$` escape goes with it, so a literal value can no longer hold a `$`
followed by a name; a secret carried in an environment variable is
unaffected, as os.Expand never rescans what it substituted.
Header names are validated with httpguts.ValidHeaderFieldName, the table
net/http itself uses, rather than a denylist that let X-Foo(bar) through.
golang.org/x/net was already in the module graph, so tidy only moves it
to the direct block.
Finally, node_http_auth.go becomes http_auth.go: the node_ prefix is for
files defining a Node type, and this one holds the auth concern of
HTTPNode plus hostMatches, which reader.go uses for trusted hosts.
Authenticating a remote Taskfile so far meant putting the credential in the
include URL, where it leaks into error messages and the confirmation prompt.
`remote.auth` configures free-form headers per host instead, so the URL stays
safe to commit. Values may reference environment variables with ${VAR}.
The headers are injected by a RoundTripper rather than set on the request:
that covers the HEAD probe RemoteExists issues before the GET, and keeps a
cross-host redirect from carrying the credentials. They are resolved when the
request is about to be made, so a cached or offline run does not require a
token it will never send.
Add //nolint:gosec annotations for intentional code patterns
that are safe in context (path traversal in release tool,
uintptr conversion for terminals, weak rand in tests,
TLS skip verify for user-configured insecure mode).
Assisted-by: Kimi-K2.5 via Crush <crush@charm.land>
* Fixed check for an existing Taskfile: look for all possibilities, and
not only `Taskfile.yml` specifically.
* Added a description (`desc`) to the `default` task. Important to at
least `task --list` work by default (a core feature).
* Changed top comment to YAML language server comment.
* feat: redact credentials in remote urls
* chore: improve function naming
* fix: TaskfileNotSecureError should use redacted URI
* feat: unexport all node implementation fields
* fix: unexport HTTPNode.url
