fix: use env credentials for pipeline push

scripts/run_pipeline.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+# Run the SQLite pipeline with the repository's dedicated Gitea credential.
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+PROJECT_ROOT=${PROJECT_ROOT:-$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)}
+ENV_FILE=${ENV_FILE:-$(CDPATH= cd -- "$PROJECT_ROOT/../direct-report-dashboard" && pwd)/.env}
+PYTHON_BIN=${PYTHON_BIN:-python3}
+
+if [ ! -r "$ENV_FILE" ]; then
+    printf '%s\n' "Credential file is not readable: $ENV_FILE" >&2
+    exit 1
+fi
+
+# Read only the two Git credential variables; do not source the .env file.
+dotenv_value() {
+    awk -v wanted="$1" '
+        $0 ~ "^[[:space:]]*" wanted "[[:space:]]*=" {
+            sub("^[[:space:]]*" wanted "[[:space:]]*=", "")
+            if ($0 ~ /^".*"[[:space:]]*$/) {
+                sub(/^"/, ""); sub(/"[[:space:]]*$/, "")
+            } else if ($0 ~ /^'"'"'.*'"'"'[[:space:]]*$/) {
+                sub(/^'"'"'/, ""); sub(/'"'"'[[:space:]]*$/, "")
+            }
+            print
+            exit
+        }
+    ' "$ENV_FILE"
+}
+
+AGENTSTAGE_USER=$(dotenv_value AGENTSTAGE_USER)
+AGENTSTAGE_TOKEN=$(dotenv_value AGENTSTAGE_TOKEN)
+if [ -z "$AGENTSTAGE_USER" ] || [ -z "$AGENTSTAGE_TOKEN" ]; then
+    printf '%s\n' "AGENTSTAGE_USER and AGENTSTAGE_TOKEN are required in $ENV_FILE" >&2
+    exit 1
+fi
+export AGENTSTAGE_USER AGENTSTAGE_TOKEN
+
+umask 077
+ASKPASS=$(mktemp "${TMPDIR:-/tmp}/af-click-gap-askpass.XXXXXX")
+cleanup() {
+    rm -f -- "$ASKPASS"
+}
+trap cleanup EXIT HUP INT TERM
+
+cat >"$ASKPASS" <<'ASKPASS_SCRIPT'
+#!/bin/sh
+case "$1" in
+    *[Uu]sername*) printf '%s\n' "$AGENTSTAGE_USER" ;;
+    *[Pp]assword*) printf '%s\n' "$AGENTSTAGE_TOKEN" ;;
+    *) exit 1 ;;
+esac
+ASKPASS_SCRIPT
+chmod 700 "$ASKPASS"
+
+export GIT_ASKPASS="$ASKPASS"
+export GIT_TERMINAL_PROMPT=0
+"$PYTHON_BIN" "$PROJECT_ROOT/scripts/af_click_gap_pipeline.py" --push "$@"
+exit $?