[cx-sumit-morchhale]

Summary

• Implement credential stripping for git remote URLs in metadata.json
• Prevents exposure of embedded tokens, PATs, and passwords
• Manager's sanitizeRepoURL() approach with comprehensive test coverage

Changes

• Added sanitizeRepoURL() function handling HTTP(S), SSH, and SCP-style URLs
• Applied to both go-git and system git fallback paths
• 14 new test cases covering all 16 URL pattern scenarios
• All 30 existing tests pass with zero regressions

Supported Platforms

✅ GitHub, GitLab, Azure DevOps, Bitbucket, self-hosted Git, SSH

Test Plan

• Unit tests: 14 new sanitizeRepoURL test cases
• Integration tests: End-to-end credential stripping verification
• Regression testing: All 30 existing tests passing
• Manual testing: Verified on GitHub, GitLab, Azure DevOps, Bitbucket

[github-actions]

⚠️ Potential secret(s) detected (unverified)

@cx-sumit-morchhale — TruffleHog found 12 potential secret(s) in this PR (0 verified, 12 unverified).

Secret Type	Status	Commit	File Path	View
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	0996fc220b	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret
URI	⚠️ unverified	6fb5248d7e	internal/commands/gitmetadata_test.go	🔎 View secret

🛠 Guidelines to remediate hardcoded secrets

• Understand the implications of revoking this secret by investigating where it is used in your code.
• Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
• Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with git-filter-repo).

To avoid such incidents in the future consider:

• Following the best practices for managing and storing secrets, including API keys and other credentials.
• Re-scan after cleanup before merging.

⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.