Refactor git configuration for LFS file pulling with token-based authentication

- Enhanced the process of configuring git to use GIT_PRIVATE_TOKEN and GITHUB_TOKEN by clearing existing URL configurations before setting new ones.
- Improved the clarity of the URL replacement commands for better readability and maintainability.
- This change ensures a more robust setup for pulling LFS files in environments requiring token authentication.

.github/workflows/cloud-runner-ci-pipeline.yml

@@ -8,6 +8,10 @@ permissions:
   checks: write
   contents: read
   actions: write
+  packages: read
+  pull-requests: write
+  statuses: write
+  id-token: write
 
 env:
   GKE_ZONE: 'us-central1'

src/model/cloud-runner/remote-client/index.ts

@@ -224,6 +224,29 @@ export class RemoteClient {
     if (!CloudRunner.buildParameters.skipLfs) {
       try {
         RemoteClientLogger.log(`Attempting to pull LFS files with GIT_PRIVATE_TOKEN...`);
+
+        // Configure git to use GIT_PRIVATE_TOKEN
+        const gitPrivateToken = process.env.GIT_PRIVATE_TOKEN;
+        if (!gitPrivateToken) {
+          throw new Error('GIT_PRIVATE_TOKEN is not available');
+        }
+
+        // Clear any existing URL configurations
+        await CloudRunnerSystem.Run(`git config --global --unset-all url."https://github.com/".insteadOf`);
+        await CloudRunnerSystem.Run(`git config --global --unset-all url."ssh://git@github.com/".insteadOf`);
+        await CloudRunnerSystem.Run(`git config --global --unset-all url."git@github.com".insteadOf`);
+
+        // Set new URL configuration with token
+        await CloudRunnerSystem.Run(
+          `git config --global url."https://${gitPrivateToken}@github.com/".insteadOf "https://github.com/"`,
+        );
+        await CloudRunnerSystem.Run(
+          `git config --global url."https://${gitPrivateToken}@github.com/".insteadOf "ssh://git@github.com/"`,
+        );
+        await CloudRunnerSystem.Run(
+          `git config --global url."https://${gitPrivateToken}@github.com/".insteadOf "git@github.com"`,
+        );
+
         await CloudRunnerSystem.Run(`git lfs pull`);
         RemoteClientLogger.log(`Successfully pulled LFS files with GIT_PRIVATE_TOKEN`);
         assert(fs.existsSync(CloudRunnerFolders.lfsFolderAbsolute));
@@ -238,15 +261,20 @@ export class RemoteClient {
             throw new Error('GITHUB_TOKEN is not available as fallback');
           }
 
-          // Configure git to use GITHUB_TOKEN
+          // Clear any existing URL configurations
+          await CloudRunnerSystem.Run(`git config --global --unset-all url."https://github.com/".insteadOf`);
+          await CloudRunnerSystem.Run(`git config --global --unset-all url."ssh://git@github.com/".insteadOf`);
+          await CloudRunnerSystem.Run(`git config --global --unset-all url."git@github.com".insteadOf`);
+
+          // Set new URL configuration with token
           await CloudRunnerSystem.Run(
-            `git config --global --replace-all url."https://token:${githubToken}@github.com/".insteadOf ssh://git@github.com/`,
+            `git config --global url."https://${githubToken}@github.com/".insteadOf "https://github.com/"`,
           );
           await CloudRunnerSystem.Run(
-            `git config --global --add url."https://token:${githubToken}@github.com/".insteadOf git@github.com`,
+            `git config --global url."https://${githubToken}@github.com/".insteadOf "ssh://git@github.com/"`,
           );
           await CloudRunnerSystem.Run(
-            `git config --global --add url."https://token:${githubToken}@github.com/".insteadOf "https://github.com/"`,
+            `git config --global url."https://${githubToken}@github.com/".insteadOf "git@github.com"`,
           );
 
           await CloudRunnerSystem.Run(`git lfs pull`);