repos with username password

tests/test_git_ingestion.py

@@ -45,3 +45,38 @@ def test_ingestion_clones_file_url(tmp_path):
         text=True,
     ).stdout.strip()
     assert branch == "main"
+
+
+def test_git_commands_fail_fast_and_accept_ephemeral_http_credentials(monkeypatch):
+    calls = []
+
+    def fake_run(command, **kwargs):
+        calls.append((command, kwargs))
+        return subprocess.CompletedProcess(
+            command,
+            128,
+            stdout="",
+            stderr="fatal: could not read Username for 'https://example.com': terminal prompts disabled",
+        )
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+
+    service = GitIngestionService()
+
+    try:
+        service._run_git(
+            ["clone", "https://example.com/private.git", "/tmp/private"],
+            cwd=None,
+            access_username="user",
+            access_password="secret",
+        )
+    except RuntimeError as exc:
+        message = str(exc)
+    else:
+        raise AssertionError("expected authentication failure")
+
+    command, kwargs = calls[0]
+    assert command[:3] == ["git", "-c", "http.extraHeader=Authorization: Basic dXNlcjpzZWNyZXQ="]
+    assert kwargs["env"]["GIT_TERMINAL_PROMPT"] == "0"
+    assert "authentication required" in message
+    assert "secret" not in message