Configure in-container git rewrite for Renovate clone auth

.gitea/workflows/renovate.yml

@@ -249,13 +249,10 @@ jobs:
           SELECTED_TOKEN_SOURCE="${SELECTED_TOKEN_RESULT%%:*}"
           SELECTED_TOKEN="${SELECTED_TOKEN_RESULT#*:}"
           export RENOVATE_TOKEN="${SELECTED_TOKEN}"
-          export RENOVATE_HOST_RULES="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"},{\"matchHost\":\"${RENOVATE_GIT_HOST}\",\"username\":\"${RENOVATE_GIT_USERNAME}\",\"password\":\"${SELECTED_TOKEN}\",\"authType\":\"Basic\"}]"
+          export RENOVATE_HOST_RULES="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"}]"
           # Rewrite external clone URLs to an authenticated internal URL for git operations.
           export RENOVATE_GIT_REWRITE_FROM="https://dogar.darkhelm.org/"
           export RENOVATE_GIT_REWRITE_TO="http://${RENOVATE_GIT_USERNAME}:${SELECTED_TOKEN}@kankali.darkhelm.lan:3001/"
-          export GIT_CONFIG_COUNT=1
-          export GIT_CONFIG_KEY_0="url.${RENOVATE_GIT_REWRITE_TO}.insteadOf"
-          export GIT_CONFIG_VALUE_0="${RENOVATE_GIT_REWRITE_FROM}"
           unset SELECTED_TOKEN RESULT_TOKEN
 
           echo "✓ Renovate auth preflight passed with ${SELECTED_TOKEN_SOURCE}"
@@ -290,10 +287,10 @@ jobs:
               -e LOG_LEVEL \
               -e NODE_TLS_REJECT_UNAUTHORIZED \
               -e GIT_SSL_NO_VERIFY=1 \
-              -e GIT_CONFIG_COUNT \
-              -e GIT_CONFIG_KEY_0 \
-              -e GIT_CONFIG_VALUE_0 \
               -e RENOVATE_TOKEN \
+              -e RENOVATE_GIT_USERNAME \
+              -e RENOVATE_GIT_REWRITE_FROM \
+              -e RENOVATE_GIT_REWRITE_TO \
               -e RENOVATE_GIT_URL \
               -e RENOVATE_HOST_RULES \
               -e RENOVATE_X_PLATFORM_VERSION \
@@ -305,15 +302,9 @@ jobs:
               -e RENOVATE_REQUIRE_CONFIG \
               -e RENOVATE_PR_CONCURRENT_LIMIT \
               -e RENOVATE_BRANCH_CONCURRENT_LIMIT \
+              --entrypoint /bin/sh \
               "${RENOVATE_IMAGE}" \
-              --platform "${RENOVATE_PLATFORM}" \
-              --endpoint "${RENOVATE_ENDPOINT}" \
-              --git-url "${RENOVATE_GIT_URL}" \
-              --git-author "${RENOVATE_GIT_AUTHOR}" \
-              --onboarding="${RENOVATE_ONBOARDING}" \
-              --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" \
-              --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" \
-              DarkHelm.org/plex-playlist
+              -lc 'set -e; git config --global "url.${RENOVATE_GIT_REWRITE_TO}.insteadOf" "${RENOVATE_GIT_REWRITE_FROM}"; renovate --platform "${RENOVATE_PLATFORM}" --endpoint "${RENOVATE_ENDPOINT}" --git-url "${RENOVATE_GIT_URL}" --git-author "${RENOVATE_GIT_AUTHOR}" --onboarding="${RENOVATE_ONBOARDING}" --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" DarkHelm.org/plex-playlist'
           }
 
           if run_renovate_with_endpoint "${BASE_ENDPOINT}" 2>&1 | tee /tmp/renovate.log; then