Description of feature
dokku_git_auth declares ProbeUnsupported with the caveat "netrc state has no read command, so the task plans as drift on every run" (tasks/git_auth_task.go:57). That was true when the task was written and is no longer true: dokku gained git:auth-status in v0.38.0, below our declared floor of 0.38.27.
The command is a comparator rather than a dump (plugins/git/internal-functions:107 in dokku):
current="$(netrc get "$HOST" 2>/dev/null)" || current=""
if [[ -z "$USERNAME" ]]; then
[[ -z "$current" ]] && return 0
return 1
fi
[[ "$current" == "${USERNAME}:${PASSWORD}" ]] && return 0
return 1It prints nothing and answers only "does the stored entry match what I am handing you", which is exactly the question Plan() needs to ask. GitAuthTask already carries Host, Username, and Password, so both states are directly expressible: git:auth-status <host> <username> <password> exits 0 when the present-state task is in sync, and git:auth-status <host> with no username exits 0 when no entry exists for the host, which is the absent-state check. subprocess.Probe is the right helper for both, since it already normalises "ran and exited non-zero" to a false verdict while still surfacing a transport failure as an error.
The password should go over stdin rather than argv. fn-git-auth-read-password reads it from stdin when the username is supplied and the password argument is omitted and stdin is a pipe, so passing it that way keeps the secret out of the process table on the dokku host. We already stream stdin to dokku in dokku_registry_auth, dokku_ssh_key, dokku_http_auth_user, and dokku_maintenance_custom_page.
This closes the probe only, not the read-back. git:auth-status cannot enumerate hosts and never reveals the stored username, so there is still nothing for an exporter to reconstruct and ExportUnsupported remains correct. What changes is that a recipe containing dokku_git_auth stops reporting drift forever, which today makes plan --detailed-exitcode unable to ever return 0 on such a recipe - the gate-a-deploy-on-no-drift workflow that flag exists for.
Bumping the probe from ProbeUnsupported to ProbeSupported also drops the --list-tasks partial-probe marker and the caveat from the generated task page, so the docs regenerate as part of this.
Description of feature
dokku_git_authdeclaresProbeUnsupportedwith the caveat "netrc state has no read command, so the task plans as drift on every run" (tasks/git_auth_task.go:57). That was true when the task was written and is no longer true: dokku gainedgit:auth-statusin v0.38.0, below our declared floor of 0.38.27.The command is a comparator rather than a dump (
plugins/git/internal-functions:107in dokku):It prints nothing and answers only "does the stored entry match what I am handing you", which is exactly the question
Plan()needs to ask.GitAuthTaskalready carriesHost,Username, andPassword, so both states are directly expressible:git:auth-status <host> <username> <password>exits 0 when the present-state task is in sync, andgit:auth-status <host>with no username exits 0 when no entry exists for the host, which is the absent-state check.subprocess.Probeis the right helper for both, since it already normalises "ran and exited non-zero" to a false verdict while still surfacing a transport failure as an error.The password should go over stdin rather than argv.
fn-git-auth-read-passwordreads it from stdin when the username is supplied and the password argument is omitted and stdin is a pipe, so passing it that way keeps the secret out of the process table on the dokku host. We already stream stdin todokkuindokku_registry_auth,dokku_ssh_key,dokku_http_auth_user, anddokku_maintenance_custom_page.This closes the probe only, not the read-back.
git:auth-statuscannot enumerate hosts and never reveals the stored username, so there is still nothing for an exporter to reconstruct andExportUnsupportedremains correct. What changes is that a recipe containingdokku_git_authstops reporting drift forever, which today makesplan --detailed-exitcodeunable to ever return 0 on such a recipe - the gate-a-deploy-on-no-drift workflow that flag exists for.Bumping the probe from
ProbeUnsupportedtoProbeSupportedalso drops the--list-taskspartial-probe marker and the caveat from the generated task page, so the docs regenerate as part of this.