@@ -358,23 +358,33 @@ func TestCheckingOutWithSSHKeyscan_WithGitMirrors(t *testing.T) {
358358 t .Fatalf ("EnableGitMirrors() error = %v" , err )
359359 }
360360
361- tester .MustMock (t , "ssh-keyscan" ).
362- Expect ("github.com" ).
363- AndWriteToStdout ("github.com ssh-rsa xxx=" ).
364- AndExitWith (0 )
365-
361+ var gitSSHCommand string
366362 git := tester .MustMock (t , "git" )
367363 git .IgnoreUnexpectedInvocations ()
368364
369365 git .
Expect (
"clone" ,
"--mirror" ,
"-v" ,
"--" ,
"[email protected] :buildkite/agent.git" ,
bintest .
MatchAny ()).
370- AndExitWith (0 )
366+ AndCallFunc (func (c * bintest.Call ) {
367+ // Capture GIT_SSH_COMMAND for verification
368+ for _ , env := range c .Env {
369+ if strings .HasPrefix (env , "GIT_SSH_COMMAND=" ) {
370+ gitSSHCommand = env
371+ break
372+ }
373+ }
374+ c .Exit (0 )
375+ })
371376
372377 env := []string {
373378 "[email protected] :buildkite/agent.git" ,
374379 "BUILDKITE_SSH_KEYSCAN=true" ,
375380 }
376381
377382 tester .RunAndCheck (t , env ... )
383+
384+ // Verify GIT_SSH_COMMAND was set with accept-new
385+ if ! strings .Contains (gitSSHCommand , "StrictHostKeyChecking=accept-new" ) {
386+ t .Errorf ("Expected GIT_SSH_COMMAND to contain 'StrictHostKeyChecking=accept-new', got: %q" , gitSSHCommand )
387+ }
378388}
379389
380390func TestCheckingOutWithoutSSHKeyscan_WithGitMirrors (t * testing.T ) {
@@ -390,19 +400,36 @@ func TestCheckingOutWithoutSSHKeyscan_WithGitMirrors(t *testing.T) {
390400 t .Fatalf ("EnableGitMirrors() error = %v" , err )
391401 }
392402
393- tester .MustMock (t , "ssh-keyscan" ).
394- Expect ("github.com" ).
395- NotCalled ()
403+ var gitSSHCommand string
404+ git := tester .MustMock (t , "git" )
405+ git .IgnoreUnexpectedInvocations ()
406+
407+ git .Expect ("clone" , "--mirror" , "-v" , "--" , "https://github.com/buildkite/bash-example.git" , bintest .MatchAny ()).
408+ AndCallFunc (func (c * bintest.Call ) {
409+ // Capture GIT_SSH_COMMAND for verification
410+ for _ , env := range c .Env {
411+ if strings .HasPrefix (env , "GIT_SSH_COMMAND=" ) {
412+ gitSSHCommand = env
413+ break
414+ }
415+ }
416+ c .Exit (0 )
417+ })
396418
397419 env := []string {
398420 "BUILDKITE_REPO=https://github.com/buildkite/bash-example.git" ,
399421 "BUILDKITE_SSH_KEYSCAN=false" ,
400422 }
401423
402424 tester .RunAndCheck (t , env ... )
425+
426+ // Verify GIT_SSH_COMMAND does NOT contain accept-new when SSHKeyscan is disabled
427+ if strings .Contains (gitSSHCommand , "StrictHostKeyChecking=accept-new" ) {
428+ t .Errorf ("Expected GIT_SSH_COMMAND to NOT contain 'StrictHostKeyChecking=accept-new', got: %q" , gitSSHCommand )
429+ }
403430}
404431
405- func TestCheckingOutWithSSHKeyscanAndUnscannableRepo_WithGitMirrors (t * testing.T ) {
432+ func TestCheckingOutWithSSHKeyscanAndHTTPSRepo_WithGitMirrors (t * testing.T ) {
406433 t .Parallel ()
407434
408435 tester , err := NewExecutorTester (mainCtx )
@@ -415,22 +442,34 @@ func TestCheckingOutWithSSHKeyscanAndUnscannableRepo_WithGitMirrors(t *testing.T
415442 t .Fatalf ("EnableGitMirrors() error = %v" , err )
416443 }
417444
418- tester .MustMock (t , "ssh-keyscan" ).
419- Expect ("github.com" ).
420- NotCalled ()
421-
445+ var gitSSHCommand string
422446 git := tester .MustMock (t , "git" )
423447 git .IgnoreUnexpectedInvocations ()
424448
449+ // Even with HTTPS repos, GIT_SSH_COMMAND is set (it just won't be used)
425450 git .Expect ("clone" , "--mirror" , "-v" , "--" , "https://github.com/buildkite/bash-example.git" , bintest .MatchAny ()).
426- AndExitWith (0 )
451+ AndCallFunc (func (c * bintest.Call ) {
452+ // Capture GIT_SSH_COMMAND for verification
453+ for _ , env := range c .Env {
454+ if strings .HasPrefix (env , "GIT_SSH_COMMAND=" ) {
455+ gitSSHCommand = env
456+ break
457+ }
458+ }
459+ c .Exit (0 )
460+ })
427461
428462 env := []string {
429463 "BUILDKITE_REPO=https://github.com/buildkite/bash-example.git" ,
430464 "BUILDKITE_SSH_KEYSCAN=true" ,
431465 }
432466
433467 tester .RunAndCheck (t , env ... )
468+
469+ // Verify GIT_SSH_COMMAND was set with accept-new even for HTTPS repos
470+ if ! strings .Contains (gitSSHCommand , "StrictHostKeyChecking=accept-new" ) {
471+ t .Errorf ("Expected GIT_SSH_COMMAND to contain 'StrictHostKeyChecking=accept-new', got: %q" , gitSSHCommand )
472+ }
434473}
435474
436475func TestCleaningAnExistingCheckout_WithGitMirrors (t * testing.T ) {
0 commit comments