feat: cert based git auth

[vsukhin]

Pull request description

Checklist (choose whats happened)

• breaking change! (describe)
• tested locally
• tested on cluster
• added new dependencies
• updated the docs
• added a test

Breaking changes

Changes

Fixes

[vsukhin]

@greptile

[greptile-apps]

Greptile Summary

This PR adds certificate-based git authentication to TestWorkflow content fetching, allowing users to supply a CA certificate, client certificate, and client private key for mutual TLS when cloning repositories. All three new fields follow the established * / *From pattern used by existing credentials (username, token, sshKey), covering inline PEM content and external K8s secret/configmap sources.

• New CaCert, ClientCert, ClientKey fields (and *From variants) are propagated consistently through the API types, deep-copy, OpenAPI spec, CRD YAML, bidirectional mappers, secrets resolver, and CLI processor.
• clone_cert.go writes each PEM value to a restricted (0400) temp file and passes the path via git -c http.sslCAInfo/sslCert/sslKey, cleaning up files on both success and error paths; the new clone_cert_test.go and secrets_test.go additions provide solid coverage for the new code paths.

Confidence Score: 5/5

Safe to merge — the new cert auth path is self-contained, follows established patterns, and is exercised by new unit tests.

All changed layers (API types, deep-copy, CRD YAML, bidirectional mappers, secrets resolver, CLI processor, and clone runtime) are updated consistently and correctly. The setupCertAuth implementation writes PEM content to restricted temp files, passes the paths via git config overrides, and cleans up on both the happy path and error paths. The utils.go concat function properly flattens []string slices, so cert args reach git correctly. No functional defects were identified.

No files require special attention.

Important Files Changed

Filename	Overview
cmd/testworkflow-toolkit/commands/clone_cert.go	New file implementing cert auth setup: writes PEM content to 0400 temp files, returns git config args and cleanup funcs; error path correctly runs prior cleanups before returning.
cmd/testworkflow-toolkit/commands/clone.go	Adds CaCert/ClientCert/ClientKey flags (-c/-e/-k) and wires setupCertAuth into RunClone; cert authArgs are appended to existing authArgs and cleaned up via defer.
pkg/testworkflows/testworkflowprocessor/operations.go	Adds CaCert/ClientCert/ClientKey arg injection following the same From/plain pattern as existing username, token, and SSH key fields.
pkg/testworkflows/testworkflowresolver/secrets.go	Adds externalization of CaCertFrom, ClientCertFrom, ClientKeyFrom computed secrets; follows the established pattern used by TokenFrom and SshKeyFrom.
api/testworkflows/v1/content_types.go	Adds six new fields to ContentGit for cert-based auth; struct tags (json, expr) are consistent with existing credential fields.

Sequence Diagram

sequenceDiagram
    participant Spec as Workflow Spec
    participant Proc as operations.go
    participant Clone as clone command
    participant CertSetup as clone_cert.go
    participant Git as git

    Spec->>Proc: ContentGit with cert fields (plain or From variant)
    Proc->>Proc: From variant: inject env var reference into args
    Proc->>Proc: Plain variant: embed cert data in args
    Proc->>Clone: Execute binary with cert flags
    Clone->>CertSetup: setupCertAuth(opts)
    CertSetup->>CertSetup: writeTempCertFile per cert field (mode 0400)
    CertSetup-->>Clone: git config args + cleanup funcs
    Clone->>Git: git with http.sslCAInfo, http.sslCert, http.sslKey overrides
    Git-->>Clone: result
    Clone->>CertSetup: defer RunCleanupFuncs removes temp files

Loading

_{Reviews (4): Last reviewed commit: "fix: use os.TempDir() in writeTempCertFi..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR extends TestWorkflow Git content handling to support TLS certificate-based access to Git repositories (custom CA, client certificate, and client key) across the API, CRDs, workflow processing, and the toolkit clone command.

Changes:

• Added caCert/clientCert/clientKey (and *From variants) to TestWorkflow Git content types and API models, including OpenAPI + CRD schema updates.
• Extended workflow secret externalization and processing to pass the new Git TLS materials into the toolkit clone invocation (env/args).
• Marked new Git TLS env vars as sensitive in the init/orchestration layer.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/testworkflows/testworkflowresolver/secrets.go	Externalizes computed CA/client cert/key values into Secrets.
pkg/testworkflows/testworkflowprocessor/operations.go	Passes CA/client cert/key into /toolkit clone via args/env.
pkg/mapper/testworkflows/openapi_kube.go	Maps new Git TLS fields from API → kube types.
pkg/mapper/testworkflows/kube_openapi.go	Maps new Git TLS fields from kube → API types.
pkg/api/v1/testkube/model_test_workflow_content_git.go	Adds new Git TLS fields to generated API model struct + docs.
api/testworkflows/v1/content_types.go	Adds new Git TLS fields to ContentGit.
api/testworkflows/v1/zz_generated.deepcopy.go	Deep-copies the new *From EnvVarSource pointers.
api/v1/testkube.yaml	Exposes new Git TLS fields in OpenAPI schema.
k8s/crd/testworkflows.testkube.io_testworkflowtemplates.yaml	CRD schema updated to include new Git TLS fields.
k8s/crd/testworkflows.testkube.io_testworkflows.yaml	CRD schema updated to include new Git TLS fields.
cmd/testworkflow-toolkit/commands/clone.go	Adds CLI flags/options for CA/client cert/key and wires into clone flow.
cmd/testworkflow-init/orchestration/setup.go	Treats new Git TLS env vars as sensitive for redaction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vsukhin]

@copilot implemented missed methods, generate crd, check open api spec

setupCertAuth and RunCleanupFuncs are called here but no implementations exist in the repository, which will break compilation of the toolkit binary. Please add these helper functions (or remove the calls) and ensure they’re wired into the clone flow correctly (e.g., writing cert/key/CA data to temp files and configuring git to use them).

[Copilot]

@copilot implemented missed methods, generate crd, check open api spec

setupCertAuth and RunCleanupFuncs are called here but no implementations exist in the repository, which will break compilation...

Implemented the missing functions in commit 5fe4e63:

• setupCertAuth(opts *CloneOptions) ([]string, []func(), error) — writes CA cert, client cert, and client key to temp files with restricted permissions (0400) and returns the corresponding git config args (http.sslCAInfo, http.sslCert, http.sslKey).
• writeTempCertFile — helper that creates a secure temp file using os.CreateTemp + os.Chmod for correct permissions.
• RunCleanupFuncs(cleanups []func()) — iterates and calls all provided cleanup functions.

Added comprehensive unit tests in clone_cert_test.go covering: empty options, individual cert/key/CA args, all-certs-set, temp-file cleanup, and restricted permissions.

The CRD and OpenAPI spec were already updated in a previous commit and confirmed to contain the new fields (caCert, clientCert, clientKey, and their *From variants).

[vsukhin]

@greptile

[Copilot]

Pull request overview

Copilot reviewed 12 out of 15 changed files in this pull request and generated 5 comments.

[vsukhin]

@copilot fix note and add unit tests

The clientCert/clientCertFrom descriptions say "verify client (testkube) TLS connection", but this field is used for git's http.sslCert (client certificate for mutual TLS) and is primarily about authenticating the client to the Git server. Please update the OpenAPI description to reflect client authentication (and keep it consistent with the Go model/CRD docs).

[Copilot]

@copilot fix note and add unit tests

The clientCert/clientCertFrom descriptions say "verify client (testkube) TLS connection", but this field is used for git's http.sslCert (client certificate for ...

Fixed in commit d295273:

• Updated clientCert/clientCertFrom/clientKey/clientKeyFrom descriptions in content_types.go from "verify client (testkube) TLS connection" to "authenticate the client to the Git server for mutual TLS" (also aligned model_test_workflow_content_git.go).
• Regenerated CRDs (make generate-crds) to propagate the updated descriptions.
• Added 4 new unit tests to secrets_test.go covering cert credential extraction: TestExtract_ContentCaCertOnly, TestExtract_ContentClientCertAndKey, TestExtract_ContentAllCerts, and TestExtractTemplate_ContentAllCerts.

[vsukhin]

@copilot validate crds using make verify-crds-generated

[Copilot]

@copilot validate crds using make verify-crds-generated

make verify-crds-generated passes with exit code 0 — all CRD files are up to date and consistent with the source types.

[vsukhin]

@copilot are crds beow 256KB annotation limit?

[Copilot]

@copilot are crds beow 256KB annotation limit?

The TestWorkflow CRDs were already well above the 256KB annotation limit before this PR — testworkflows.yaml was 772KB and testworkflowtemplates.yaml was 742KB at the merge base (commit 559b308). Our new caCert/clientCert/clientKey fields added ~9.5KB and ~9KB respectively, but the project was already in this state and handles it (the Makefile strips descriptions from specific high-volume keys like securityContext, volumes, etc., to reduce size, and the Helm charts likely use server-side apply which avoids the annotation entirely).

make verify-crds-generated passes cleanly (exit code 0), confirming the generated CRDs are consistent with the source types and the reduction pipeline ran correctly.

[vsukhin]

@greptile

[Copilot]

Pull request overview

Copilot reviewed 13 out of 19 changed files in this pull request and generated 2 comments.