Valentin Maerten 8a93190060 feat(remote): add remote.auth to send HTTP headers when downloading Taskfiles ...

Authenticating a remote Taskfile so far meant putting the credential in the
include URL, where it leaks into error messages and the confirmation prompt.
`remote.auth` configures free-form headers per host instead, so the URL stays
safe to commit. Values may reference environment variables with ${VAR}.

The headers are injected by a RoundTripper rather than set on the request:
that covers the HEAD probe RemoteExists issues before the GET, and keeps a
cross-host redirect from carrying the credentials. They are resolved when the
request is about to be made, so a cached or offline run does not require a
token it will never send.

2026-08-23 12:11:08 +02:00

16 KiB

Raw Blame History

View Raw