feat: propagate git PAT to ~/.netrc for dependency authentication

When using PAT authentication, write the token to ~/.netrc so that
git operations triggered by uv sync (e.g. fetching private git
dependencies listed in pyproject.toml) can authenticate using the
same credentials as the main repository clone.

Refs: SUPPORT-15344
Co-Authored-By: Zora Jelínková <zora.jelinkova@keboola.com>

Author: devin-ai-integration[bot]

src/source_git.py

@@ -3,6 +3,7 @@
 import subprocess
 import sys
 from pathlib import Path
+from urllib.parse import urlparse
 
 from keboola.component.exceptions import UserException
 
@@ -43,8 +44,20 @@ def _set_up_token_auth(self) -> None:
         self.repo_auth_url = self.git_cfg.url.replace(
             "https://", f"https://x-token-auth:{self.git_cfg.encrypted_token}@"
         )
+        self._set_up_netrc(self.git_cfg.url, self.git_cfg.encrypted_token)
         logging.info("Git token authentication set up for HTTPS URL.")
 
+    @staticmethod
+    def _set_up_netrc(repo_url: str, token: str) -> None:
+        parsed = urlparse(repo_url)
+        if not parsed.hostname:
+            return
+        netrc_path = Path.home() / ".netrc"
+        entry = f"machine {parsed.hostname}\nlogin x-token-auth\npassword {token}\n"
+        with open(netrc_path, "a") as f:
+            f.write(entry)
+        os.chmod(netrc_path, 0o600)
+
     def _set_up_ssh_command(self) -> None:
         if not self.git_cfg.ssh_keys.keys.encrypted_private:
             if self.git_cfg.auth == AuthEnum.SSH: