`glab repo clone path/repo` puts token in repo/.git/config instead of relying on global configuration

Created by: cweidinger

Description glab repo clone path/repo

$ cat .git/config
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
	ignorecase = true
	precomposeunicode = true
[remote "origin"]
	url = https://user:access_token@gitlab.com/path/repo.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	remote = origin
	merge = refs/heads/master

The access_token is put in the repo's configuration instead of storing it globally.

Expected Behavior vs Actual Behavior Since the access token is global in nature in glab, it shouldn't be putting it in individual repos. When a token expires and the user glab auth login again, they still can't git pull the repo b/c the the access token was hard coded on clone.

Possible Fix Use global git password management when cloning repo. Maybe it's as simple as not putting the access token in the .git/config and having the user type it in but it'd obviously be better if you could auto populate it for the user.

Steps to Reproduce see above

Your Environment

  • glab version 1.13.1 (2020-12-29)
  • mac $ cat ~/.gitconfig ... [credential] helper = osxkeychain
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information