prevent write actions in the Git handler

[jakecoffman]

What are you trying to accomplish?

We never give Dependabot write access tokens in production, however someone else may be using this Proxy and not realize the danger. So we can block write actions in the handler to make it safer.

I would still suggest giving read-only tokens to the proxy just-in-case, but the objective of this Proxy is to make it safe to run external code, so any write actions should be blocked.

Anything you want to highlight for special attention from reviewers?

I'm adding a specific message when blocking the request so if somehow this does cause any production issues, customers will find this PR:

blocked authentication for non-read-only git request

How will you know you've accomplished your goal?

I have run an interactive test locally with a real Git server and is successfully blocks all the write attempts I made.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Restricts proxy-provided Git credentials to read-only operations.

Changes:

• Blocks Git write requests with a clear 403 response.
• Allows upload-pack and LFS downloads.
• Adds coverage for Git and GitHub API request methods.

Show a summary per file

File	Description
internal/handlers/github_api_test.go	Tests read-only API authentication.
internal/handlers/git_server.go	Classifies and blocks write operations.
internal/handlers/git_server_test.go	Tests allowed, blocked, and retry behavior.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Balanced