Actions/Source/Git.ps1

<#
.SYNOPSIS
Source action: clone a git repository and use it as the configuration source.
 
.DESCRIPTION
Clones any git remote (HTTPS or SSH) into a scoped temporary directory and returns
that path. This is the generic, provider-agnostic replacement for the old
Azure-DevOps-only clone path — GitHub, GitLab, Bitbucket and Azure DevOps all speak
the same git-over-HTTPS/SSH protocol.
 
Authentication, when needed, is resolved through Get-PipelineAuthToken: an explicit
context token (SecureString or string) takes precedence, otherwise the pipeline-provided
$env:SYSTEM_ACCESSTOKEN is used. The module's `git` wrapper injects the resolved token
as an HTTP Authorization header without exposing it on the process command line.
 
.PARAMETER Context
A hashtable. Recognized keys:
  Url - the git remote to clone (required).
  Token - optional credential (PAT / JIT) for git-over-HTTPS auth; a [SecureString]
             or a plain string. When omitted, $env:SYSTEM_ACCESSTOKEN is used if present.
  Revision - optional branch, tag, or commit to check out after cloning.
 
.OUTPUTS
[string] The local directory the repository was cloned into.
#>

# $JITToken is assigned here and read by the module's `git` wrapper from this scope
# (dynamic scoping) to build the HTTP Authorization header — the analyzer cannot see that
# cross-function use and flags it as unused. The assignment is required.
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', 'JITToken',
    Justification = 'Read from this scope by the git wrapper (dynamic scoping) to build the auth header.')]
param(
    [hashtable]$Context = @{}
)

$url = $Context.Url
if ([string]::IsNullOrWhiteSpace($url)) {
    # Fall back to Path for callers that pass a source location under a single key.
    $url = $Context.Path
}

if ([string]::IsNullOrWhiteSpace($url)) {
    throw "[Actions/Source/Git] No 'Url' supplied in the action context."
}

# Resolve the credential into a SecureString: an explicit Context.Token, else the
# pipeline-provided $env:SYSTEM_ACCESSTOKEN. The `git` wrapper reads $JITToken from
# this scope to build the HTTP Authorization header. $null means an unauthenticated
# clone (public remote / local path).
$JITToken = Get-PipelineAuthToken -Token $Context.Token

Write-Verbose "[Actions/Source/Git] Cloning '$url'."
$clonePath = Clone-Repository -DatumURLConfig $url

# Optionally pin to a specific revision.
if (-not [string]::IsNullOrWhiteSpace($Context.Revision)) {
    Write-Verbose "[Actions/Source/Git] Checking out revision '$($Context.Revision)'."
    $null = git -C $clonePath checkout $Context.Revision
}

return $clonePath