feat: add credential manager configuration to the oclif init hook

[jdodson]

Summary

In order to ensure that our customers are able to continue working with their existing Heroku projects without interruption, we are going to temporarily add the configuration of the git credential manager to the oclif init hook in the CLI. The plan is to add it now and then remove it potentially as part of the v12 release of the CLI.

What's done:

• Configure the git credential manager via an oclif init hook so it runs on every CLI command
• Adding unit tests covering hook behavior and registration to handle regressions

Type of Change

Breaking Changes (major semver update)

• Add a ! after your change type to denote a change that breaks current behavior

Feature Additions (minor semver update)

• feat: Introduces a new feature to the codebase

Patch Updates (patch semver update)

• fix: Bug fix
• deps: Dependency upgrade
• revert: Revert a previous commit
• chore: Change that does not affect production code
• refactor: Refactoring existing code without changing behavior
• test: Add/update/remove tests

Testing

Build first:

npm install ; npm run build

This change adds a hook that runs before every CLI command and tells git to use heroku git:credentials for Heroku git operations. The steps below confirm it works, runs everywhere it should, and never breaks a command.

Replace git.heroku.com below if testing against a non-default host.

First, clear the setting so you can watch the hook add it:

git config --global --unset-all credential.https://git.heroku.com.helper

1. It configures the helper when you run a command. Run any command, then check git:

./bin/run apps --help
git config --global --get credential.https://git.heroku.com.helper

Expected: !heroku git:credentials

2. It does NOT run for --version, -v, the version command, autocomplete, or bare heroku. For each skipped invocation below, clear the setting first, run the command, then check that nothing was added:

git config --global --unset-all credential.https://git.heroku.com.helper
./bin/run --version
git config --global --get credential.https://git.heroku.com.helper

git config --global --unset-all credential.https://git.heroku.com.helper
./bin/run -v
git config --global --get credential.https://git.heroku.com.helper

git config --global --unset-all credential.https://git.heroku.com.helper
./bin/run version
git config --global --get credential.https://git.heroku.com.helper

git config --global --unset-all credential.https://git.heroku.com.helper
./bin/run autocomplete:options apps
git config --global --get credential.https://git.heroku.com.helper

git config --global --unset-all credential.https://git.heroku.com.helper
./bin/run
git config --global --get credential.https://git.heroku.com.helper

Expected: nothing printed after any of the --get checks (the setting was not added)

3. It never breaks a command, even if git is missing. The key safety check — run with a PATH that has node but no git, so the hook's git call fails:

mkdir -p /tmp/nogit && ln -sf "$(which node)" /tmp/nogit/node
PATH=/tmp/nogit ./bin/run version

Expected: the version prints and the command exits normally (no crash, no error from the hook)

Screenshots (if applicable)

Related Issues

GUS work item: https://gus.lightning.force.com/lightning/r/ADM_Work__c/a07EE00002coSPMYA2/view

[erika-wallace]

LGTM. I had a few suggestions/questions about the code though.

[erika-wallace]

Should we comment out / temporarily remove the configureCredentialHelper() call in login, apps:create, git:clone, and git:remote since we would be configuring git twice - once in the init hook and again in the actual command?

[jdodson]

@k80bowman What do you think? I don't think so but maybe?

[jdodson]

My thinking is that we keep it because they're the permanent path once the temporary hook is removed at v12.

The idempotency check already makes the duplicate call a no-op. (According to Claude)

[erika-wallace]

With the check, that makes sense to me