From 607745ecfdcfd4c5610add82a67e14a424cc2bb3 Mon Sep 17 00:00:00 2001 From: bcherb2 Date: Sat, 22 Aug 2026 22:33:32 -0400 Subject: [PATCH] test: lab asserts GitHub reads stay https after the private tier applies --- .tests/lab/scenarios/30-private-tier.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.tests/lab/scenarios/30-private-tier.sh b/.tests/lab/scenarios/30-private-tier.sh index dff7650..af9210a 100644 --- a/.tests/lab/scenarios/30-private-tier.sh +++ b/.tests/lab/scenarios/30-private-tier.sh @@ -190,4 +190,16 @@ done ls "$HOME/.config/zsh"/.secrets.zsh.* >/dev/null 2>&1 && fail "a temp file survived a failed refresh" ok "a failed refresh leaves secrets.zsh byte-identical and no temp file behind" +# ---- GitHub reads stay anonymous https after the tier applies --------------- +# The tier ships a git@github.com: rewrite for PUSHES. If it ever regresses to +# a blanket insteadOf, every https clone on a keyless fresh box breaks -- the +# first casualty was nvim's plugin bootstrap (live, 2026-08-22). +# Plain `git config --get`, not --global: --global does not follow the +# [include] seam by default, which made this pair pass vacuously. +git config --get 'url.git@github.com:.insteadof' >/dev/null 2>&1 \ + && fail "GitHub https READS are rewritten to ssh — a keyless box cannot clone plugins" +git config --get 'url.git@github.com:.pushinsteadof' >/dev/null 2>&1 \ + || fail "the GitHub push-over-ssh rewrite is gone entirely" +ok "GitHub reads stay https; only pushes are rewritten to ssh" + echo "PRIVATE TIER PASS"