fix: redact GitHub token from git errors

[infraclaw-dash]

What

• use x-access-token as the non-secret URL username and place GITHUB_TOKEN in the password position
• update all three credential URL rewrites in the Dockerfile
• prevent Git authentication errors from printing the credential

Verification

• synthetic invalid credential was absent from Git stderr
• all three rewrites use the password position
• git diff --check passed

This targets the head branch of #4147 because infraclaw-dash does not have direct push permission to dashpay/platform.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ed557191-3267-48c4-8168-cad834b08877

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 417f7b0)
Last checked: 2026-07-22 19:02 UTC

[shumkov]

@thepastaclaw@infraclaw-dash are you sure docker image is building well?

[QuantumExplorer]

Superseded by 475f09f, which landed directly on the base branch (codex/fix-docker-build-secret-logging / #4147): it applies the same x-access-token: username form at all three insteadOf sites, and additionally brings the build-js stage up to the same standard (-s guard for empty secret files + EXIT-trap cleanup). The conflict here was this branch's context still expecting the pre-fix lines. Nothing from this PR is lost — thanks for the catch on git's username-vs-password redaction behavior.

[thepastaclaw]

I checked the actual workflow results: neither this PR nor the superseding #4147 exercised the Dockerfile. In both runs, Build Docker images was skipped because the test workflow only builds images on a platform version change, the nightly schedule, or manual dispatch. So there is no CI evidence from these PR runs that the images build. The redaction change did land in #4147 as 475f09f; the next nightly/manual workflow run is the first full image-build validation.

[thepastaclaw]

@shumkov The nightly run has now exercised the Docker builds, and no—the images are not building successfully yet.

All three image jobs (Drive, RS-DAPI, and Dashmate helper) failed in build-planner before reaching the GitHub credential/dependency-fetch stages. cargo chef prepare cannot load the newly added document-history-contract workspace member because packages/document-history-contract/Cargo.toml is absent from the Docker build context. The Dockerfile's explicit package copy lists were not updated when #4171 added that crate.

So the credential-redaction change from #4147 is not implicated in this failure, but it also still has not been exercised end-to-end by CI because the build stops earlier.

Nightly run: https://github.com/dashpay/platform/actions/runs/29965837295
Representative failed job: https://github.com/dashpay/platform/actions/runs/29965837295/job/89077700709