fix(ENGKNOW-3363): fix security vuln in exec gor git

gortools/src/main/java/org/gorpipe/gor/cli/git/GitCloneCommand.java

@@ -78,7 +78,7 @@ public void run() {
 
         File workingDir = parentCommand.getWorkingDirectory(".");
 
-        GitCommandExecutor.executeGitCommand("clone", args, workingDir, spec);
+        GitCommandExecutor.executeGitCommand("clone", args, workingDir, spec, parentCommand.getGitToken());
     }
 }
 

gortools/src/main/java/org/gorpipe/gor/cli/git/GitCommand.java

@@ -38,11 +38,14 @@ public String getFullRepositoryPath(String repository) {
         String user = System.getenv("GOR_GIT_USER");
         String pass = System.getenv("GOR_GIT_TOKEN");
         if (user != null && pass != null) {
-            var userPass = "%s:%s@".formatted(user, pass);
-            return "https://%sgithub.com/GeneDx/%s.git".formatted(userPass, repository);
-        } else {
-            return "git@github.com:GeneDx/%s.git".formatted(repository);
+            return "https://%s:%s@github.com/GeneDx/%s.git"
+                    .formatted(user, GitCommandExecutor.TOKEN_PLACEHOLDER, repository);
         }
+        return "git@github.com:GeneDx/%s.git".formatted(repository);
+    }
+
+    public String getGitToken() {
+        return System.getenv("GOR_GIT_TOKEN");
     }
 
     public File getWorkingDirectory(String directory) {

gortools/src/main/java/org/gorpipe/gor/cli/git/GitCommandExecutor.java

@@ -17,6 +17,8 @@
  */
 class GitCommandExecutor {
 
+    static final String TOKEN_PLACEHOLDER = "__GIT_TOKEN__";
+
     /**
      * Execute a git command with the given arguments.
      *
@@ -26,15 +28,25 @@ class GitCommandExecutor {
      * @param commandSpec the CommandLine spec for error reporting
      * @return the exit code of the git command
      */
-    static int executeGitCommand(String gitSubcommand, List<String> args, File workingDir, 
+    static int executeGitCommand(String gitSubcommand, List<String> args, File workingDir,
                                   CommandLine.Model.CommandSpec commandSpec) {
+        return executeGitCommand(gitSubcommand, args, workingDir, commandSpec, null);
+    }
+
+    static int executeGitCommand(String gitSubcommand, List<String> args, File workingDir,
+                                  CommandLine.Model.CommandSpec commandSpec, String token) {
         List<String> command = new ArrayList<>();
         command.add("git");
         command.add(gitSubcommand);
         command.addAll(args);
 
+        // Resolve token placeholder just before exec — command retains placeholder for safe error messages
+        List<String> execCommand = token != null
+                ? command.stream().map(a -> a.replace(TOKEN_PLACEHOLDER, token)).collect(Collectors.toList())
+                : command;
+
         try {
-            ProcessBuilder pb = new ProcessBuilder(command);
+            ProcessBuilder pb = new ProcessBuilder(execCommand);
             if (workingDir != null && workingDir.isDirectory()) {
                 pb.directory(workingDir);
             }

gortools/src/main/java/org/gorpipe/gor/cli/git/GitFetchCommand.java

@@ -94,6 +94,6 @@ public void run() {
 
         File workingDir = parentCommand.getWorkingDirectory(directory);
 
-        GitCommandExecutor.executeGitCommand("fetch", args, workingDir, spec);
+        GitCommandExecutor.executeGitCommand("fetch", args, workingDir, spec, parentCommand.getGitToken());
     }
 }

gortools/src/main/java/org/gorpipe/gor/cli/git/GitPullCommand.java

@@ -90,7 +90,7 @@ public void run() {
 
         File workingDir = parentCommand.getWorkingDirectory(directory);
 
-        GitCommandExecutor.executeGitCommand("pull", args, workingDir, spec);
+        GitCommandExecutor.executeGitCommand("pull", args, workingDir, spec, parentCommand.getGitToken());
     }
 }
 

gortools/src/main/java/org/gorpipe/gor/cli/git/GitPushCommand.java

@@ -90,7 +90,7 @@ public void run() {
 
         File workingDir = parentCommand.getWorkingDirectory(directory);
 
-        GitCommandExecutor.executeGitCommand("push", args, workingDir, spec);
+        GitCommandExecutor.executeGitCommand("push", args, workingDir, spec, parentCommand.getGitToken());
     }
 }