Support private repositories in remote sources

[MrPunyapal]

What

Remote sources can now authenticate to private Git repositories.

• New SourceCredentials resolver. Manifest entries accept an optional token key and an optional username key (default x-access-token).
• Token values in the form ${ENV_VAR} resolve from the environment at sync time. A variable that is not set produces a clear configuration error naming the variable and the target.
• Without a token key, fallbacks apply: DOCSMITH_TOKEN works for any host, then GITHUB_TOKEN or GH_TOKEN but only when the repository host is github.com, so a GitHub Actions token is never sent to third-party hosts.
• SourceSynchronizer passes resolved credentials to git-reader 0.2 through withCredentials().
• When a repository cannot be found and no credentials were resolved, the error now suggests that the repository may be private and how to provide a token.

Why

docsmith.sources.php currently only supports public repositories, which blocks syncing internal packages. Authentication belongs at the transport layer, so git-reader 0.2 gained HTTP basic auth and this change wires manifest configuration into it without docsmith knowing any transport details.

Notes for review

• Requires mrpunyapal/git-reader 0.2.0 (released).
• md/remote-sources.md documentation updates are intentionally not part of this branch yet and will follow after review.
• The token test suite covers env references, missing variables, literal passthrough, fallback priority, the github.com host guard, and username defaults.

pint, phpstan, and pest pass (81 tests, 296 assertions).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e44eaf2c-0e0f-4712-ba71-7d80ba48c881

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}