Disable interactive git credential prompts on fetch operations

[bschellenberger2600]

Summary

• Pin github.com/git-fire/git-harness v0.3.1 and delegate PrepareNetworkGit to harness (no duplicated helper)
• Apply non-interactive fetch behavior on default fetch --all, mainline fetch, and full sync paths
• Migrate .goreleaser.stable.yaml from deprecated brews → homebrew_casks (fixes failing release config validation)

Why

Parallel git-rain workers were leaking interactive HTTPS credential prompts when remotes lacked cached credentials. The fix belongs in git-harness (shared with git-fire); git-rain now consumes it instead of maintaining a forked copy.

Related PRs

• git-harness (merged, v0.3.1): Disable interactive git credential prompts on network operations git-harness#9
• git-fire (consumer tests): Regression tests for non-interactive git network failures git-fire#107

Test plan

• go test -race -count=1 ./...
• go.mod pins github.com/git-fire/git-harness v0.3.1
• CI green (including Validate GoReleaser Configs)

---

Note

Medium Risk
Changes how every parallel fetch handles missing credentials (fail fast instead of prompting), which is intentional but affects all remote fetch paths; release packaging also switches to homebrew_casks.

Overview
Parallel fetches were able to trigger interactive HTTPS username/password prompts, which mixed badly with scan and multi-repo progress output. This PR wires non-interactive network git through all remote fetch entry points.

Runtime behavior: New internal/git.PrepareNetworkGit delegates to git-harness (v0.3.1) so fetch/push-style commands get the same env as git-fire (e.g. GIT_TERMINAL_PROMPT=0). It is applied in fetchOnly (cmd), MainlineFetchRemotes, and the initial fetch inside RainRepository.

Tests: Coverage for fetchFailureReason when git reports terminal prompts disabled, an HTTPS integration test that fetch fails without prompting, and a cmd test case for the default-fetch error message path.

Release: Stable GoReleaser config moves from brews to homebrew_casks, with a post-install hook to strip macOS quarantine on the binary.

^{Reviewed by Cursor Bugbot for commit 3983ecb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

@bschellenberger2600, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 46 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0449b1d9-1b70-4e3e-b22a-6d37651da88c

📥 Commits

Reviewing files that changed from the base of the PR and between 3b65f5e and 3983ecb.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (8)

• .goreleaser.stable.yaml
• cmd/root.go
• cmd/root_test.go
• go.mod
• internal/git/command.go
• internal/git/command_test.go
• internal/git/fetch_mainline.go
• internal/git/rain.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/non-interactive-git-network

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Stale comment

Not approving: the Cursor Bugbot check completed successfully, but the expected Cursor Bugbot review comment is missing from this PR. Human review is needed before merge; no reviewers were assigned because the only repo collaborator is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Homebrew gate expects Formula
  • Updated the release workflow to poll Casks/git-rain.rb (matching homebrew_casks) instead of Formula/git-rain.rb.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 3983ecb. Configure here.}

[cursor]

Homebrew gate expects Formula

High Severity

Stable release config now publishes homebrew_casks (Cask under Casks/) instead of brews (Formula/git-rain.rb), but the release workflow still waits for Formula/git-rain.rb to update. GoReleaser can succeed while the Homebrew verify step times out and fails the release.

 

^{Reviewed by Cursor Bugbot for commit 3983ecb. Configure here.}

[cursor]

Not approving: Cursor Bugbot reported one unresolved high-severity finding (Homebrew Formula vs Cask gate mismatch in .goreleaser.stable.yaml) and the Bugbot check finished in a skipped state. Human review is needed before merge; no reviewers were assigned because the only repo collaborator is the PR author.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}