[renatoathaydes]

Why

Agents running unattended in a workspace lose git access as soon as the user's laptop sleeps. Both ways DevPod provides git credentials depend on the laptop:

• ssh remotes use the ssh-agent forwarded over the devpod ssh connection;
• https remotes use a credential helper that calls back to the laptop.

SSH can't fix this without putting private keys in the workspace. This PR makes git use https instead, with credentials that the dev container provides. DevPod doesn't handle tokens itself, so it stays agnostic of GitHub, Bitbucket and other hosts.

What

• New context option GIT_SSH_TO_HTTPS (auto | true | false, default auto). auto turns it on when SSH_AGENT_FORWARDING=false.

  • It's resolved on devpod up and passed to the container in CLIOptions (two new fields; older agents ignore them).

• What container setup does when it's on. This runs before any lifecycle hook:

  • It collects the workspace source URL and the remote.*.url / submodule.*.url entries of the repository in the workspace folder. It reads the config files directly, so it isn't affected by safe.directory checks, and it follows worktree .git files.
  • It writes url."https://<host>/".insteadOf rules for the URL's own ssh prefix, git@<host>: and ssh://git@<host>/.
  • The rules go into /var/devpod/ssh-to-https.gitconfig, which is included from the system git config.
  • The repository's .git/config is not touched. That matters for local-folder workspaces, where it is the user's own checkout.
  • When the option is off, the next up removes the file and the include.

• New context option GIT_SSH_TO_HTTPS_HOSTS: extra hosts, or explicit from=to rewrites for servers whose ssh and https paths differ (e.g. Bitbucket Data Center's :7999/ vs /scm/).

• Fix: removeCredentialHelper used to delete the whole [credential] section of the global gitconfig at the end of a session, including helpers the user or dev container added. It now removes only DevPod's own helper line.

• Docs: a new page, Run Workspaces Unattended, explaining:

  • what depends on the laptop;
  • exactly what DevPod changes;
  • the options to set;
  • token choices for GitHub and Bitbucket;
  • an env-var credential helper script (tested with git credential fill) and a gh alternative;
  • the inactivity timeout;
  • how to verify the setup.

  The credentials page links to it. CHANGELOG updated.

Testing

• New unit tests:
  • URL prefix parsing;
  • rewrite generation, including explicit overrides;
  • config formatting;
  • a test that runs real git remote get-url --push against the generated config, covering ssh, ssh://…:7999 with an explicit rewrite, and https remotes;
  • remote discovery in a repo and in a worktree;
  • the credential-helper removal;
  • the auto resolution.
• go test ./pkg/... ./cmd/..., go vet and golangci-lint v1.60.1 pass locally. The docs build passes with no new broken links or anchors.
• Not done: an end-to-end devpod up against Docker. Docker wasn't available locally.

🤖 Generated with Claude Code