Repository: apache/airflow
File: providers/git/src/airflow/providers/git/bundles/git.py (Python)

Code before:
            self.prune_dotgit_folder = False
        else:
            self.prune_dotgit_folder = prune_dotgit_folder

        self._log = log.bind(
            bundle_name=self.name,
            version=self.version,
            bare_repo_path=self.bare_repo_path,
            repo_path=self.repo_path,
            versions_path=self.versions_dir,
            git_conn_id=self.git_conn_id,
            submodules=self.submodules,
        )

        self._log.debug("bundle configured")
        self.hook: GitHook | None = None
        try:
            self.hook = GitHook(git_conn_id=git_conn_id or "git_default", repo_url=self.repo_url)
        except Exception as e:
            if not self.repo_url:
                # when repo_url is not provided, we need the connection to get it and if we fail here, we raise
                raise
            # if repo_url is provided, connection can be optional for auth, so we log and continue to enable
            # public repos to work without connection
            self._log.info(
                "Could not create GitHook, proceeding without authentication for public repository",
                git_conn_id=git_conn_id,
                exc_info=str(e),
            )

        if self.hook and self.hook.repo_url:
            self.repo_url = self.hook.repo_url
            self._log.debug("repo_url updated from hook")

    def _initialize(self):
        with self.lock():
            cm = self.hook.configure_hook_env() if self.hook else nullcontext()
            with cm:
                try:
                    self._clone_bare_repo_if_required()
                except GitCommandError as e:
                    raise RuntimeError("Error cloning repository") from e
                except InvalidGitRepositoryError as e:
                    raise RuntimeError(f"Invalid git repository at {self.bare_repo_path}") from e
                self._ensure_version_in_bare_repo()
            self.bare_repo.close()

            try:
                self._clone_repo_if_required()
            except GitCommandError as e:
                raise RuntimeError("Error cloning repository") from e

Review comment (security):
This is a bit blurry honestly... since we use the normal git binary, things like your system ssh keys can still be used for auth too. So there may be auth still, it just may not come from Airflow.

Code after:
            self.prune_dotgit_folder = False
        else:
            self.prune_dotgit_folder = prune_dotgit_folder

        self._log = log.bind(
            bundle_name=self.name,
            version=self.version,
            bare_repo_path=self.bare_repo_path,
            repo_path=self.repo_path,
            versions_path=self.versions_dir,
            git_conn_id=self.git_conn_id,
            submodules=self.submodules,
        )

        self._log.debug("bundle configured")
        self.hook: GitHook | None = None
        try:
            self.hook = GitHook(git_conn_id=git_conn_id or "git_default", repo_url=self.repo_url)
        except Exception as e:
            if not self.repo_url:
                # when repo_url is not provided, we need the connection to get it and if we fail here, we raise
                raise
            # if repo_url is provided, connection can be optional for auth, so we log and continue to enable
            # public repos to work without connection
            self._log.info(
                "Connection not found but repo_url provided, continuing without Airflow connection",
                git_conn_id=git_conn_id,
                exc_info=str(e),
            )

        if self.hook and self.hook.repo_url:
            self.repo_url = self.hook.repo_url
            self._log.debug("repo_url updated from hook")

    def _initialize(self):
        with self.lock():
            cm = self.hook.configure_hook_env() if self.hook else nullcontext()
            with cm:
                try:
                    self._clone_bare_repo_if_required()
                except GitCommandError as e:
                    raise RuntimeError("Error cloning repository") from e
                except InvalidGitRepositoryError as e:
                    raise RuntimeError(f"Invalid git repository at {self.bare_repo_path}") from e
                self._ensure_version_in_bare_repo()
            self.bare_repo.close()

            try:
                self._clone_repo_if_required()
            except GitCommandError as e:
                raise RuntimeError("Error cloning repository") from e