Skip to content

Default port (:443/:80) added to clone URLs breaks credential helpers #1918

Description

@d-enk

Summary

gitlab-ci-local adds default port numbers (:443 for HTTPS, :80 for HTTP) to URLs used for git clone when fetching include:project and include:component. This breaks git credential helpers (e.g. glab auth git-credential) that match credentials by exact URL — https://git.example.com and https://git.example.com:443 are treated as different hosts.

Minimal reproduction

  1. Self-hosted GitLab at https://git.example.com (no explicit port in remote URL)
  2. Git credential helper configured for https://git.example.com:
    [credential "https://git.example.com"]
        helper =
        helper = !glab auth git-credential
  3. .gitlab-ci.yml with a project include:
    include:
      - project: 'group/ci-templates'
        file: '.gitlab-ci.yml'
  4. Run:
    gitlab-ci-local --list

Expected behavior

git clone uses the same URL as git remote get-url origin (without explicit default port), so credential helpers match and authentication works.

Actual behavior

gitlab-ci-local reconstructs the URL with :443 appended:

git clone -n --depth=1 --filter=tree:0 https://git.example.com:443/group/ci-templates.git

Credential helper for https://git.example.com does not match https://git.example.com:443 → git prompts for username/password:

Username for 'https://git.example.com:443':

Root cause

Introduced in #1202 (commit d9431ab). src/git-data.ts sets default ports:

let port = "443";
if (gitRemoteMatch.groups.schema === "https") {
    port = gitRemoteMatch.groups.port ?? "443";
} else if (gitRemoteMatch.groups.schema === "http") {
    port = gitRemoteMatch.groups.port ?? "80";
}

Then src/parser-includes.ts uses ${remote.host}:${remote.port} in git clone URLs, always including the port even when it's a default.

Workaround

Add a duplicate credential entry with the port:

[credential "https://git.example.com:443"]
    helper =
    helper = !glab auth git-credential

Suggested fix

Don't append the port to clone URLs when it's a default (443 for HTTPS, 80 for HTTP). Alternatively, store an empty string for default ports and conditionally include :${port} only when non-empty.

Environment

  • gitlab-ci-local: 4.74.0
  • OS: Linux

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions