Better documentation on git credential-manager store

[KirillOsenkov]

We are in a CI environment and can't use UI. We obtain a token for auth to push to Azure Repos, but not sure what's the right way to add the token to Git.

I'm failing to find good documentation on git credential-manager store. It just says you don't need to use it, but it probably implies I'm a regular user in a UI scenario, not a service account on a CI machine.

[KirillOsenkov]

This is all I see:

[dscho]

I think the canonical way to store a credential is via git credential approve, not via the credential helper. Does that help?

If you need to use git credential-manager store, here is the implementation of that command, and it looks as if it accepted the username and password input the same way as git credential approve, i.e. <key>=<value> pairs provided via stdin.

[KirillOsenkov]

Thanks, I'll look into approve (it wasn't very intuitive :))

The issue remains though - the docs for store are lacking. Whatever it's doing needs to be documented.

[dscho]

Thanks, I'll look into approve (it wasn't very intuitive :))

Heh. Git's credential machinery was not designed to be used like that. For pre-authentication, I think the idea was to use a non-interactive credential helper like git credential-netrc.

Granted, the only really useful credential helper that is shipped with Git for Windows (which you seem to need to be using) is GCM.

The issue remains though - the docs for store are lacking. Whatever it's doing needs to be documented.

This lack of documentation is probably due to the fact that this store subcommand is part of the "protocol" Git speaks to the credential helpers, as documented here: https://git-scm.com/docs/gitcredentials#_custom_helpers. Therefore, it's not really up to GCM how this subcommand works, it has to abide by Git's rules, which are already documented in the Git project 😉

[KirillOsenkov]

Understood, thanks for the explanation.

[mjcheetham]

@KirillOsenkov if you're looking to use GCM and authentication from automation for Azure Repos you may also like to look at the service principal and managed identity support in GCM https://aka.ms/gcm/misp

Otherwise, @dscho is correct that using git credential approve is the best way to pre-load a credential to GCM. git-credential-manager [get|store|erase] are not meant to be called by anyone other than Git itself. The user facing equivalents of get|store|erase is provided by Git's git credential [fill|approve|reject].. confusing, I know! 😅