fix: argo-cd git submodule is using SSH auth instead of HTTPs (#3118)

util/git/client.go

@@ -60,6 +60,7 @@ type Client interface {
 	Root() string
 	Init() error
 	Fetch(revision string) error
+	Submodule() error
 	Checkout(revision string, submoduleEnabled bool) error
 	LsRefs() (*Refs, error)
 	LsRemote(revision string) (string, error)
@@ -382,6 +383,17 @@ func (m *nativeGitClient) LsLargeFiles() ([]string, error) {
 	return ss, nil
 }
 
+// Submodule embed other repositories into this repository
+func (m *nativeGitClient) Submodule() error {
+	if err := m.runCredentialedCmd("git", "submodule", "sync", "--recursive"); err != nil {
+		return err
+	}
+	if err := m.runCredentialedCmd("git", "submodule", "update", "--init", "--recursive"); err != nil {
+		return err
+	}
+	return nil
+}
+
 // Checkout checkout specified revision
 func (m *nativeGitClient) Checkout(revision string, submoduleEnabled bool) error {
 	if revision == "" || revision == "HEAD" {
@@ -405,7 +417,7 @@ func (m *nativeGitClient) Checkout(revision string, submoduleEnabled bool) error
 	}
 	if _, err := os.Stat(m.root + "/.gitmodules"); !os.IsNotExist(err) {
 		if submoduleEnabled {
-			if err := m.runCredentialedCmd("git", "submodule", "update", "--init", "--recursive"); err != nil {
+			if err := m.Submodule(); err != nil {
 				return err
 			}
 		}

util/git/client_test.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -93,6 +94,120 @@ func Test_nativeGitClient_Fetch_Prune(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+func Test_nativeGitClient_Submodule(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "")
+	require.NoError(t, err)
+
+	foo := filepath.Join(tempDir, "foo")
+	err = os.Mkdir(foo, 0755)
+	require.NoError(t, err)
+
+	cmd := exec.Command("git", "init")
+	cmd.Dir = foo
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	bar := filepath.Join(tempDir, "bar")
+	err = os.Mkdir(bar, 0755)
+	require.NoError(t, err)
+
+	cmd = exec.Command("git", "init")
+	cmd.Dir = bar
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	cmd = exec.Command("git", "commit", "-m", "Initial commit", "--allow-empty")
+	cmd.Dir = bar
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	// Embed repository bar into repository foo
+	cmd = exec.Command("git", "submodule", "add", bar)
+	cmd.Dir = foo
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	cmd = exec.Command("git", "commit", "-m", "Initial commit")
+	cmd.Dir = foo
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	tempDir, err = os.MkdirTemp("", "")
+	require.NoError(t, err)
+
+	// Clone foo
+	cmd = exec.Command("git", "clone", foo)
+	cmd.Dir = tempDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	client, err := NewClient(fmt.Sprintf("file://%s", foo), NopCreds{}, true, false, "")
+	require.NoError(t, err)
+
+	err = client.Init()
+	require.NoError(t, err)
+
+	err = client.Fetch("")
+	assert.NoError(t, err)
+
+	commitSHA, err := client.LsRemote("HEAD")
+	assert.NoError(t, err)
+
+	// Call Checkout() with submoduleEnabled=false.
+	err = client.Checkout(commitSHA, false)
+	assert.NoError(t, err)
+
+	// Check if submodule url does not exist in .git/config
+	cmd = exec.Command("git", "config", "submodule.bar.url")
+	cmd.Dir = client.Root()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	assert.Error(t, err)
+
+	// Call Submodule() via Checkout() with submoduleEnabled=true.
+	err = client.Checkout(commitSHA, true)
+	assert.NoError(t, err)
+
+	// Check if the .gitmodule URL is reflected in .git/config
+	cmd = exec.Command("git", "config", "submodule.bar.url")
+	cmd.Dir = client.Root()
+	result, err := cmd.Output()
+	assert.NoError(t, err)
+	assert.Equal(t, bar+"\n", string(result))
+
+	// Change URL of submodule bar
+	cmd = exec.Command("git", "config", "--file=.gitmodules", "submodule.bar.url", bar+"baz")
+	cmd.Dir = client.Root()
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	require.NoError(t, err)
+
+	// Call Submodule()
+	err = client.Submodule()
+	assert.NoError(t, err)
+
+	// Check if the URL change in .gitmodule is reflected in .git/config
+	cmd = exec.Command("git", "config", "submodule.bar.url")
+	cmd.Dir = client.Root()
+	result, err = cmd.Output()
+	assert.NoError(t, err)
+	assert.Equal(t, bar+"baz\n", string(result))
+}
+
 func TestNewClient_invalidSSHURL(t *testing.T) {
 	client, err := NewClient("ssh://bitbucket.org:org/repo", NopCreds{}, false, false, "")
 	assert.Nil(t, client)