[Mariatta]

The worker embedded GH_AUTH in the clone URL and the upstream remote URL. When a git command failed, the CalledProcessError traceback printed the full command line, token included, into the logs. This happened during the cabotage cutover, so the current token needs to be rotated separately.

The token is now supplied through a git credential helper that reads GH_AUTH from the environment when git asks for it. The clone and remote URLs are plain, so the token no longer appears in command lines, in .git/config, or in tracebacks. Pushes by cherry_picker go through the same helper.

Adds a test that runs setup_cpython_repo with a sentinel token and asserts it is absent from every git command.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ab3712e) to head (0cd0d84).

@@            Coverage Diff            @@
##              main      #749   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            7         7           
  Lines          356       366   +10     
  Branches        12        12           
=========================================
+ Hits           356       366   +10     

Flag	Coverage Δ
Python_3.11	100.00% <100.00%> (ø)
Python_3.12	100.00% <100.00%> (ø)
Python_3.13	100.00% <100.00%> (ø)
Python_3.14	100.00% <100.00%> (ø)
Python_3.15	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
tests/test_tasks.py	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Mariatta]

I am rotating the auth token after this.