fix(git): system-git fallback for Azure DevOps repositories (#288)

go-git v5 strips MultiACK/MultiACKDetailed from its capability
advertisement. ADO rejects any upload-pack request that omits
multi_ack with HTTP 400 (TF401041: "Clients must support multi-ack.").

This change adds a per-URL system-git fallback: any remote whose URL
contains dev.azure.com, visualstudio.com, or ssh.dev.azure.com is
routed through exec.Command("git", ...) instead of go-git. All other
providers continue to use the existing go-git path unchanged.

Three entry points now delegate to system git for ADO URLs:
- SmartFetch → systemGitSmartFetch (git ls-remote + git fetch)
- PushAtomic → systemGitPushAtomic (git ls-remote + git push --force-with-lease)
- CheckRepo  → systemGitCheckRepo  (git ls-remote --symref)

Credentials are never passed via argv:
- BasicAuth: GIT_CONFIG_GLOBAL with http.extraHeader = Authorization: Basic <base64>
- TokenAuth: GIT_CONFIG_GLOBAL with http.extraHeader = Authorization: Bearer <token>
- SSH: GIT_SSH_COMMAND with -i <keyfile> and optional known_hosts

Dockerfile: adds a git-bundle Alpine stage that collects git and all
its musl shared-library dependencies via ldd, then copies them into
the distroless final image. The distroless/static:debug base already
includes /bin/sh (busybox), which is required to execute the
GIT_ASKPASS script.

Proper fix: go-git PR #1204 (full multi_ack implementation) is targeted
for v6.0.0, which is still in alpha as of 2026-07-28. Drop this
fallback and upgrade to go-git v6 once a stable release lands.

Author: consooo

Dockerfile

@@ -49,6 +49,33 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     -ldflags "-X main.version=${VERSION} -X main.gitCommit=${GIT_COMMIT} -X main.gitDirty=${GIT_DIRTY} -X main.buildDate=${BUILD_DATE}" \
     -o manager ./cmd
 
+# Bundle git and all its shared-library deps (musl libc, openssl, curl, etc.) so that
+# the final distroless image can shell out to git for Azure DevOps repositories (which
+# require multi_ack capability that go-git v5 does not implement).
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS git-bundle
+RUN set -eux; \
+    apk add --no-cache git openssh-client; \
+    mkdir -p /bundle/bin /bundle/lib /bundle/usr/lib /bundle/usr/libexec; \
+    cp -L /usr/bin/git /bundle/bin/; \
+    cp -L /usr/bin/ssh /bundle/bin/; \
+    cp -rL /usr/libexec/git-core /bundle/usr/libexec/; \
+    cp -L /lib/ld-musl*.so* /bundle/lib/; \
+    for f in /usr/bin/git \
+             /usr/bin/ssh \
+             /usr/libexec/git-core/git-remote-http \
+             /usr/libexec/git-core/git-remote-https; do \
+        [ -f "$f" ] || continue; \
+        ldd "$f" 2>/dev/null \
+            | awk '/ => /{ print $3 }' \
+            | while read -r so; do \
+                [ -f "$so" ] || continue; \
+                case "$so" in \
+                    /lib/*)     cp -Ln "$so" /bundle/lib/     2>/dev/null || true ;; \
+                    /usr/lib/*) cp -Ln "$so" /bundle/usr/lib/ 2>/dev/null || true ;; \
+                esac; \
+            done; \
+    done
+
 FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS sops-downloader
 ARG TARGETARCH
 # Keep current: the CI image-scan gate fails on fixable CRITICALs in this
@@ -69,6 +96,15 @@ FROM gcr.io/distroless/static:debug@sha256:e741251ccc55dd6cec4a99ff21c0766df3189
 WORKDIR /
 COPY --from=builder /workspaces/manager .
 COPY --from=sops-downloader /usr/local/bin/sops /usr/local/bin/sops
+# git, ssh, and their musl-linked deps for the ADO system-git fallback.
+# busybox provides /bin/sh so git can invoke GIT_SSH_COMMAND via shell parsing.
+# Alpine's busybox is musl-linked and needs only the libs already copied below.
+COPY --from=git-bundle /bin/busybox                 /bin/sh
+COPY --from=git-bundle /bundle/bin/git              /usr/bin/git
+COPY --from=git-bundle /bundle/bin/ssh              /usr/bin/ssh
+COPY --from=git-bundle /bundle/usr/libexec/git-core /usr/libexec/git-core
+COPY --from=git-bundle /bundle/lib/                 /lib/
+COPY --from=git-bundle /bundle/usr/lib/             /usr/lib/
 USER 65532:65532
 
 ENTRYPOINT ["/manager"]

docs/configuration.md

@@ -92,6 +92,29 @@ spec:
     - main
 ```
 
+### Azure DevOps repositories
+
+Azure DevOps (`dev.azure.com`, `*.visualstudio.com`, `ssh.dev.azure.com`) is supported.
+Use **HTTPS with a Personal Access Token** as the recommended credential. ADO PATs must be
+sent as HTTP Basic auth with an empty username and the PAT as the password:
+
+```yaml
+spec:
+  url: https://dev.azure.com/<org>/<project>/_git/<repo>
+  secretRef:
+    name: ado-creds   # Secret with keys: username (empty string) and password (your PAT)
+```
+
+Microsoft Entra ID (OAuth) access tokens use the `bearerToken` Secret key instead.
+SSH is also supported using the `ssh.dev.azure.com` URL format with standard `ssh-privatekey` and `known_hosts` credentials.
+
+> **Implementation note:** go-git v5 does not implement the `multi_ack` capability that ADO
+> requires (ADO rejects requests without it with HTTP 400). The operator automatically routes
+> ADO URLs through the system `git` binary instead. This is transparent — no configuration
+> change is needed — but requires `git` to be present in the container image. The published
+> image includes it. This fallback will be removed once go-git v6 ships with full `multi_ack`
+> support (tracked in go-git PR #1204).
+
 ### `GitProvider.spec.secretRef`: the credentials Secret
 
 The referenced Secret holds the Git credentials. The examples use the **Kubernetes-native** keys,