Renovate fails with "GIT_ASKPASS is not permitted" after simple-git 3.36.0 update

[Chumper]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub Enterprise Server

Which version of Renovate are you using?

43.249.4

Please tell us more about your question or problem

Similar to #42740.

With the upgrade a setup like this wont work with Renovate anymore:

# Set up git authentication
cat > /tmp/.git-askpass <<'EOF'
#!/bin/bash
echo "$GHEC_TOKEN"
EOF
chmod +x /tmp/.git-askpass
export GIT_ASKPASS=/tmp/.git-askpass

# Configure git URL rewrites
git config --global url."https://api@github.com/".insteadOf "https://github.com/"
git config --global url."https://ssh@github.com/".insteadOf "ssh://git@github.com/"
git config --global url."https://git@github.com/".insteadOf "git@github.com:"

renovate ...

This fails with a similar message:

Use of GIT_ASKPASS is not permitted without enabling allowUnsafeAskPass

We should add another option here: https://github.com/renovatebot/renovate/blob/main/lib/util/git/config.ts#L22
Either as default or behind an environment variable.

I can imagine something like this:

  const unsafe: SimpleGitOptions['unsafe'] = {
    allowUnsafeSshCommand: true, // For custom `GIT_SSH_COMMAND`.
    allowUnsafeConfigEnvCount: true, // For custom `GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_*` and `GIT_CONFIG_VALUE_*`.
  };
  if (getEnv().RENOVATE_X_CLEAR_HOOKS) {
    unsafe.allowUnsafeHooksPath = true;
  }
  if (getEnv().RENOVATE_X_ALLOW_ASK_PASS) {
    unsafe.allowUnsafeAskPass = true;
  }

Logs (if relevant)

No response

[viceice]

I'll push a fix soon

[viceice]

• fix(git): allow overriding GIT_ASKPASS #44322