[match] fail fast for SSH authentication prompts in non-interactive shell#30078
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates match’s Git operations to avoid hanging in non-interactive environments by centralizing Git-related environment variables and introducing SSH fail-fast behavior via BatchMode=yes.
Changes:
- Replaces inline
Helper.with_env_values('GIT_TERMINAL_PROMPT' => '0')usage with a sharedgit_env_valueshelper for clone/push. - Adds logic intended to enforce non-interactive SSH behavior by augmenting
GIT_SSH_COMMANDwith-o BatchMode=yes. - Adds specs around
git_env_valuesbehavior with/without an existingGIT_SSH_COMMAND.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| match/lib/match/storage/git_storage.rb | Introduces git_env_values / non_interactive_git_ssh_command and uses them for clone + push env setup. |
| match/spec/storage/git_storage_spec.rb | Adds unit tests covering the new env helper behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
iBotPeaches
changed the title
|
Is there an easy way for me to test this locally short of setting up a real match github repo and not having the auth in my keychain? |
|
@iBotPeaches You don't need to set up a real match repo for this. Here are two quick ways to test: Option 1: Test the code directly ruby-e" require_relative 'match/lib/match/storage/git_storage' storage = Match::Storage::GitStorage.new env=storage.send(:git_env_values) puts 'Environment variables:" env.each { |k, v| puts " #{k}=#{v}"} #Output: GIT_TERMINAL PROMPT=0, GIT_SSH_COMMAND=ssh-o BatchMode=yes Option 2: Test with a bare repo git init --bare /tmp/test-repo.git git clone file:///tmp/test-repo.git /tmp/clone-test \ -C GIT TERMINAL PROMPT=01 \ -C GIT_SSH_COMMAND="ssh-o BatchMode=yes" #Should clone successfully I've tested both locally and everything checks out. The code generates the right env vars and git operations work as expected. 🙏 let me know if you need anything else. |
iBotPeaches
left a comment
iBotPeaches
left a comment
There was a problem hiding this comment.
I confirmed testing with my ssh-agent empty (thus stalled forever) and this which didn't.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @PratikPatil131 👋
Thank you for your contribution to fastlane and congrats on getting this pull request merged 🎉
The code change now lives in the master branch, however it wasn't released to RubyGems yet.
We usually ship about once a month, and your PR will be included in the next one.
Please let us know if this change requires an immediate release by adding a comment here 👍
We'll notify you once we shipped a new release with your changes 🚀"
There was a problem hiding this comment.
Congratulations! 🎉 This was released as part of fastlane 2.237.0 🚀
Summary
This PR makes
matchfail fast instead of hanging when SSH authentication requires interactive input (for example, passphrase or password prompts in non-interactive CI environments).matchalready setsGIT_TERMINAL_PROMPT=0, which prevents interactive Git/HTTPS credential prompts. However, SSH authentication prompts can still block indefinitely. This change enables non-interactive SSH behavior by default formatchGit operations usingBatchMode=yes.What changed
Reuse the shared Git environment helper for
matchclone and push operations.Continue setting:
GIT_TERMINAL_PROMPT=0Add default SSH fail-fast behavior:
GIT_SSH_COMMANDwith-o BatchMode=yes.Preserve any existing user-provided
GIT_SSH_COMMANDand append-o BatchMode=yesonly if it is not already present.Add tests covering:
GIT_SSH_COMMANDis unset.BatchMode=yesto an existingGIT_SSH_COMMAND.BatchMode=yesoptions.Why
Without this change,
matchcan appear to hang indefinitely while waiting for SSH authentication input that is unavailable in CI or other non-interactive environments. EnablingBatchMode=yescauses SSH to fail immediately with a clear authentication error instead of waiting for user input.Backward compatibility
BatchModeis a long-standing and widely supported OpenSSH option.GIT_SSH_COMMANDvalues are preserved.matchGit operations by converting hangs into fast failures.Related issue
Fixes: #26591
Checklist
bundle exec rspecfrom the root directory to see all new and existing tests passbundle exec rubocop -ato ensure the code style is validci/circlecibuilds in the "All checks have passed" section of my PR (connect CircleCI to GitHub if not)