fix: disable git credential cache during builds

backend/services/build_service.py

@@ -66,6 +66,16 @@ _ERROR_RULES = [
 ]
 
 
+def _git_env() -> dict:
+    """为无人值守的构建任务禁用交互提示与凭据缓存写入。"""
+    env = os.environ.copy()
+    env["GIT_TERMINAL_PROMPT"] = "0"
+    return env
+
+
+_GIT_NO_CREDENTIAL_HELPER = ("git", "-c", "credential.helper=")
+
+
 def _classify_build_error(output_lines: list, step: str) -> tuple:
     """解析构建输出，返回 (category, friendly_message)
 
@@ -145,6 +155,7 @@ async def update_source(task_id: str, source_dir: Path, branch: str):
     """将共享源码工作目录强制同步到指定远程分支。"""
     remote_url = get_git_remote_url(with_credentials=True)
     remote_url_masked = mask_git_remote_url(remote_url)
+    git_env = _git_env()
 
     cloned = not source_dir.exists()
     if cloned:
@@ -153,7 +164,8 @@ async def update_source(task_id: str, source_dir: Path, branch: str):
         source_dir.parent.mkdir(parents=True, exist_ok=True)
         await log_streamer.emit(task_id, f"初始化共享源码目录: {remote_url_masked}")
         process = await asyncio.create_subprocess_exec(
-            "git", "clone", remote_url, str(source_dir),
+            *_GIT_NO_CREDENTIAL_HELPER, "clone", remote_url, str(source_dir),
+            env=git_env,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.STDOUT,
         )
@@ -173,7 +185,8 @@ async def update_source(task_id: str, source_dir: Path, branch: str):
 
     if remote_url:
         process = await asyncio.create_subprocess_exec(
-            "git", "remote", "set-url", "origin", remote_url,
+            *_GIT_NO_CREDENTIAL_HELPER, "remote", "set-url", "origin", remote_url,
+            env=git_env,
             cwd=str(source_dir), stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.STDOUT,
         )
         await process.wait()
@@ -188,7 +201,8 @@ async def update_source(task_id: str, source_dir: Path, branch: str):
     ]
     for command, error_message in commands:
         process = await asyncio.create_subprocess_exec(
-            *command, cwd=str(source_dir), stdout=asyncio.subprocess.PIPE,
+            *_GIT_NO_CREDENTIAL_HELPER, *command[1:], env=git_env,
+            cwd=str(source_dir), stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.STDOUT,
         )
         async for line in process.stdout: