setup-project.py: the credential-helper check says store and every other helper "answer git's question for github.com" and counts any helper as configured, though one holding nothing answers nothing, so setup is silent on a push with no login #992

Goal: setup-project.py's credential-helper check says only what is true of a helper that keeps logins (store): it answers git's question for github.com once a login is stored in it, and not before.

Filed by lane openRepoShape-3, from RV971's review of #971, its NIT-3 (comment 6254110331), on #971. Lane 3 ruled that NIT-3 goes to a follow-up issue and is not in #971's fix round.

State. Read at origin/main ae63d450. #971 (open, a draft; heads e40af32d and, after its fix round, 155fcd2d) does not touch these lines.

• _credential_helper_configured() (setup-project.py:1288-1301) is titled "Will ANYTHING answer git's credential question for github.com?" It runs git config --get-all for credential.https://github.com.helper and for credential.helper, and answers True when either holds any text. That is whether a helper is CONFIGURED. It never asks whether a login is in it.
• _check_credential_helper (:1304-1340) leaves a machine with a helper alone, and its docstring says why (:1312-1318): "osxkeychain, Windows' manager, store, a devcontainer's own: they all answer git's question for github.com without gh being involved ... A helper that is not gh's still pushes." The warning (:1333) and the offer of gh auth setup-git are for a machine with NO helper only.
• tests/test_setup_project_py.py:1539 (test_a_credential_helper_that_is_not_ghs_is_left_alone) holds "left alone" and repeats the sentence in its docstring (:1541-1544).

What happens. Measured at ae63d450, with a scratch HOME, GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_GLOBAL a file holding credential.helper = store, and an EMPTY ~/.git-credentials. No network is asked: a helper that holds nothing answers nothing, and with the terminal prompt off git has no way to ask.

_credential_helper_configured(), no helper at all:       False   -> the check warns and offers `gh auth setup-git`
_credential_helper_configured(), helper=store, empty:    True    -> the check says nothing

printf 'protocol=https\nhost=github.com\n\n' | GIT_TERMINAL_PROMPT=0 git credential fill
fatal: could not read Username for 'https://github.com': terminal prompts disabled          exit 128

So "answers git's question" is false of store while nothing is stored, and so is "still pushes". It does not bite at main: a first scaffold's push in a terminal asks once, and RV971 measured it succeeding there (on main git asked once, all three pushed, exit 0, and the credential was stored). It bites once #971 lands, which runs every push with git's terminal prompt off: RV971 measured the same machine (store over an empty file) at #971's e40af32d as exit 2, could not read Username ... terminal prompts disabled, all three repositories left empty. At 155fcd2d that refusal now names the fix (_login_remedy, scaffold-project.py:1684), but only AFTER the repositories exist. Setup's check could have said it before anything exists, and says the opposite.

Evidence.

• The probe above, and the lines.
• RV971's NIT-3 text: "setup-project.py:1307-1313 says a storage helper answers git's question, which is false while nothing is stored (follow-up)" (its numbers are from before setup-project.py and validate-repository-naming.py: step (4) reads and names what step (5) does, --link-remedy reads a link holding =, strips its words and notes an unused one, and the Windows hand clone passes -c core.autocrlf=false (#907, #926) #949 moved the file down five lines), and its MUST-1 measurement of the same machine.
• Not measured here: osxkeychain and Windows' manager, which this host has neither of. I do not claim what they do with nothing stored. The sentence in the docstring can be made true without ruling on them.

Direction.

• The docstring and the question's title first, in all three places (:1289, :1312-1318, the test's docstring tests/test_setup_project_py.py:1541-1544): a configured helper is not a stored login. Say of store, the one kind measured here, that it answers only with a login in it; cache keeps logins in memory and would be the same by its design, but I did not run it. Say nothing of the others.
• Then decide whether the check says it too. git credential fill is NOT a safe question for a check: it runs every configured helper, and a helper may open a window or ask at a keychain. A narrower reading: where the helper is exactly store (with or without --file=<path>), read the credential file git would read (~/.git-credentials, $XDG_CONFIG_HOME/git/credentials, or the --file) for a github.com line, and warn as for no helper where there is none. cache keeps no file to read. If the author wants the check to stay a pure config read, the wording change is the whole fix, and scaffold-project.py: a first scaffold's pushes and a --reuse-empty-repo re-run's pushes and seed fetch no longer ask at the terminal: a push git has no login for fails naming the fix, and a leg git reaches over ssh is refused with ssh's reason (#915) #971's refusal at the first push stays the place that says it.
• Keep it out of the checked list and keep --dry-run offering nothing (setup-project.py: a passed-through -- --dry-run still offers gh auth setup-git, which writes the person's global git config on a typed yes, and checked_ref passes a.lock/b, which git refuses #857): a warning that refuses is a refusal. setup-project.py is not a pinned copy, so no project re-pins.
• Related, and its own issue: a stored login the host REJECTS (fatal: Authentication failed) is a different failure with no remedy at the push; that is the scaffold's, not this check's.

Verify.

• grep -n "they all answer git's question" setup-project.py tests/test_setup_project_py.py finds nothing, and the new wording says a store helper answers only with a login stored.
• If the check is extended: a machine with credential.helper=store and a credentials file that is empty or absent gets the [??] and the offer, one with a github.com line in it gets nothing, --preflight exits 0 either way, and a dry run warns and offers nothing. Rows beside test_the_credential_helper_is_a_warning_not_a_refusal (tests/test_setup_project_py.py:1520), and test_a_credential_helper_that_is_not_ghs_is_left_alone changed to say what it holds.
• tests/test_setup_project_py.py -k "credential", then the file; run one file at a time under a stub gh.

Size: S.

Lane: openreposhape-3 (openRepoShape-3)