fix: use liuji pipeline credentials

scripts/run_pipeline.sh

@@ -3,7 +3,8 @@
 set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-PROJECT_ROOT=${PROJECT_ROOT:-$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)}
+PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+# ENV_FILE is an explicit override; by default it is the sibling dashboard .env.
 ENV_FILE=${ENV_FILE:-$(CDPATH= cd -- "$PROJECT_ROOT/../direct-report-dashboard" && pwd)/.env}
 PYTHON_BIN=${PYTHON_BIN:-python3}
 
@@ -30,12 +31,40 @@ dotenv_value() {
 
 AGENTSTAGE_USER=$(dotenv_value AGENTSTAGE_USER)
 AGENTSTAGE_TOKEN=$(dotenv_value AGENTSTAGE_TOKEN)
-if [ -z "$AGENTSTAGE_USER" ] || [ -z "$AGENTSTAGE_TOKEN" ]; then
-    printf '%s\n' "AGENTSTAGE_USER and AGENTSTAGE_TOKEN are required in $ENV_FILE" >&2
+missing=''
+[ -n "$AGENTSTAGE_USER" ] || missing="$missing AGENTSTAGE_USER"
+[ -n "$AGENTSTAGE_TOKEN" ] || missing="$missing AGENTSTAGE_TOKEN"
+if [ -n "$missing" ]; then
+    printf 'Missing required .env variable(s):%s\n' "$missing" >&2
+    exit 1
+fi
+if [ "$AGENTSTAGE_USER" != "liuji" ]; then
+    printf '%s\n' "AGENTSTAGE_USER must be liuji" >&2
     exit 1
 fi
 export AGENTSTAGE_USER AGENTSTAGE_TOKEN
 
+# Override Git only for this process tree: never read osxkeychain and never alter .git/config.
+REMOTE_URL=$(git -C "$PROJECT_ROOT" config --get remote.origin.url || true)
+case "$REMOTE_URL" in
+    https://*)
+        REMOTE_TARGET=${REMOTE_URL#https://}
+        REMOTE_TARGET=${REMOTE_TARGET#*@}
+        REMOTE_URL="https://liuji@$REMOTE_TARGET"
+        ;;
+    *)
+        printf '%s\n' "remote.origin.url must use HTTPS" >&2
+        exit 1
+        ;;
+esac
+export GIT_CONFIG_COUNT=3
+export GIT_CONFIG_KEY_0=credential.helper
+export GIT_CONFIG_VALUE_0=
+export GIT_CONFIG_KEY_1=remote.origin.url
+export GIT_CONFIG_VALUE_1="$REMOTE_URL"
+export GIT_CONFIG_KEY_2=remote.origin.pushurl
+export GIT_CONFIG_VALUE_2="$REMOTE_URL"
+
 umask 077
 ASKPASS=$(mktemp "${TMPDIR:-/tmp}/af-click-gap-askpass.XXXXXX")
 cleanup() {