feat(git): support GITHUB_TOKEN env var as netrc auth fallback (#1156)

* feat(git): support GITHUB_TOKEN env var as netrc auth fallback

Adds a third auth path to setupGithubTokenNetrc, publish, and ensureGit
so platforms that inject a pre-provisioned installation token (e.g.
freestyle) can use HTTPS git auth without needing GITHUB_APP_CONFIGURED
or GITHUB_APP_KEY.

Priority order:
1. GITHUB_APP_CONFIGURED — self-provisions scoped tokens via GitHub App
2. GITHUB_APP_KEY         — fetches token via admin API
3. GITHUB_TOKEN           — writes the env var directly to ~/.netrc

Made-with: Cursor

* fix: let admin API token failure fall through to GITHUB_TOKEN

When GITHUB_APP_KEY is set but getGitHubToken() returns undefined (e.g.
admin API unavailable), the early return was silently skipping the
GITHUB_TOKEN fallback. Invert the check so a successful token
short-circuits while undefined falls through to the next branch.

Made-with: Cursor

Author: guitavano

daemon/git.ts

@@ -18,6 +18,7 @@ const SOURCE_PATH = Deno.env.get("SOURCE_ASSET_PATH");
 const DEFAULT_TRACKING_BRANCH = Deno.env.get("DECO_TRACKING_BRANCH") ?? "main";
 const REPO_URL = Deno.env.get("DECO_REPO_URL");
 const GITHUB_APP_KEY = Deno.env.get("GITHUB_APP_KEY");
+const GITHUB_TOKEN = Deno.env.get("GITHUB_TOKEN");
 const BUILD_FILES_DIR = Deno.env.get("BUILD_FILES_DIR");
 const ADMIN_DOMAIN = "https://admin.deco.cx";
 
@@ -249,7 +250,7 @@ export const publish = ({ build }: Options): Handler => {
     const author = body.author || { name: "decobot", email: "capy@deco.cx" };
     const message = body.message || `New release by ${author.name}`;
 
-    if (GITHUB_APP_CONFIGURED || GITHUB_APP_KEY) {
+    if (GITHUB_APP_CONFIGURED || GITHUB_APP_KEY || GITHUB_TOKEN) {
       // Re-read the remote URL so we refresh the token for the correct repo
       // (important for self-hosted / external repos).
       const remoteUrl = await git.remote(["get-url", "origin"]).catch(
@@ -514,10 +515,20 @@ export const setupGithubTokenNetrc = async (
   }
 
   // Fallback: fetch token via admin API
-  const token = await getGitHubToken();
-  if (token === undefined) return;
+  if (GITHUB_APP_KEY) {
+    const token = await getGitHubToken();
+    if (token !== undefined) {
+      await updateNetrc(token);
+      return;
+    }
+    // token is undefined (e.g. admin API unavailable) — fall through to GITHUB_TOKEN
+  }
 
-  await updateNetrc(token);
+  // Fallback: use a pre-provisioned GITHUB_TOKEN injected by the platform
+  // (e.g. freestyle environments where a scoped installation token is passed directly).
+  if (GITHUB_TOKEN) {
+    await updateNetrc(GITHUB_TOKEN);
+  }
 };
 
 /**
@@ -677,7 +688,7 @@ export const ensureGit = async ({
       ? parseGitHubOwnerRepo(effectiveRepoUrl) ?? undefined
       : undefined;
 
-    if (GITHUB_APP_CONFIGURED || GITHUB_APP_KEY) {
+    if (GITHUB_APP_CONFIGURED || GITHUB_APP_KEY || GITHUB_TOKEN) {
       await setupGithubTokenNetrc(repoOverride);
     }
 
@@ -686,7 +697,7 @@ export const ensureGit = async ({
       return;
     }
 
-    const useHttps = GITHUB_APP_CONFIGURED || GITHUB_APP_KEY;
+    const useHttps = GITHUB_APP_CONFIGURED || GITHUB_APP_KEY || GITHUB_TOKEN;
     const cloneUrl = repoUrl ??
       REPO_URL ??
       (useHttps