fix: classify git failures on stderr, restrict migration failure detail (#39010)

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/migrations/error.go

@@ -6,6 +6,9 @@ package migrations
 
 import (
 	"errors"
+	"net/http"
+
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/google/go-github/v91/github"
 )
@@ -24,3 +27,12 @@ func IsTwoFactorAuthError(err error) bool {
 	_, ok := err.(*github.TwoFactorAuthError)
 	return ok
 }
+
+// IsAuthenticationError returns true if the remote rejected the credentials, over git or over its HTTP API
+func IsAuthenticationError(err error) bool {
+	if gitcmd.IsStderr(err, gitcmd.StderrAuthenticationFailed, gitcmd.StderrCouldNotReadUsername) {
+		return true
+	}
+	githubErr, ok := errors.AsType[*github.ErrorResponse](err)
+	return ok && githubErr.Response != nil && githubErr.Response.StatusCode == http.StatusUnauthorized
+}

services/migrations/migrate.go

@@ -130,7 +130,8 @@ func MigrateRepository(ctx context.Context, doer *user_model.User, ownerName str
 		if err1 := uploader.Rollback(); err1 != nil {
 			log.Error("rollback failed: %v", err1)
 		}
-		if err2 := system_model.CreateRepositoryNotice(fmt.Sprintf("Migrate repository (%s/%s) from %s failed: %v", ownerName, opts.RepoName, opts.OriginalURL, err)); err2 != nil {
+		noticeMsg := fmt.Sprintf("Migrate repository (%s/%s) from %s failed: %v", ownerName, opts.RepoName, util.SanitizeCredentialURLs(opts.OriginalURL), util.SanitizeErrorCredentialURLs(err))
+		if err2 := system_model.CreateRepositoryNotice(noticeMsg); err2 != nil {
 			log.Error("create repository notice failed: ", err2)
 		}
 		return nil, err

services/migrations/migrate_test.go

@@ -4,17 +4,44 @@
 package migrations
 
 import (
+	"errors"
+	"fmt"
 	"net"
+	"net/http"
 	"path/filepath"
 	"testing"
 
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
+	"github.com/google/go-github/v91/github"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestIsAuthenticationError(t *testing.T) {
+	errDummy := errors.New("dummy")
+	cases := []struct {
+		name string
+		want bool
+		err  error
+	}{
+		{"git authentication failed", true, gitcmd.NewRunStdError(errDummy, "fatal: Authentication failed for 'https://host/repo.git/'")},
+		{"git could not read username", true, fmt.Errorf("%w", gitcmd.NewRunStdError(errDummy, "fatal: could not read Username for 'https://host'"))},
+		{"github unauthorized", true, util.SanitizeErrorCredentialURLs(&github.ErrorResponse{Response: &http.Response{StatusCode: http.StatusUnauthorized}})},
+		{"github other", false, &github.ErrorResponse{Response: &http.Response{StatusCode: http.StatusNotFound}}},
+		{"github nil response", false, &github.ErrorResponse{}},
+		{"unrelated error", false, errDummy},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, IsAuthenticationError(c.err))
+		})
+	}
+}
+
 func TestMigrateWhiteBlocklist(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())