fix: persist Gitea credentials across AI sessions

tests/test_credential_oauth_identity.py

@@ -0,0 +1,35 @@
+import importlib.util
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+
+
+SCRIPTS = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts"
+sys.path.insert(0, str(SCRIPTS))
+spec = importlib.util.spec_from_file_location("credential_oauth_identity_test", SCRIPTS / "credential_oauth_identity.py")
+identity = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(identity)
+
+
+class IdentityTest(unittest.TestCase):
+    def test_reports_api_login_without_disclosing_token(self):
+        class Response:
+            def __enter__(self): return self
+            def __exit__(self, *args): pass
+            def read(self, limit): return b'{"login":"alice"}'
+        class Opener:
+            def open(self, request, timeout): return Response()
+        def get(namespace, operation, fields, output):
+            output.write(b"username=oauth2\npassword=fake-secret-token\n")
+        with patch.object(identity.vault, "run", side_effect=get):
+            self.assertEqual(identity.lookup("https://example.invalid", "gitea-oauth-" + "a" * 32, Opener()), "alice")
+
+    def test_empty_vault_result_is_rejected(self):
+        with patch.object(identity.vault, "run"), self.assertRaises(identity.IdentityError):
+            identity.lookup("https://example.invalid", "gitea-oauth-" + "a" * 32, object())
+
+
+if __name__ == "__main__":
+    unittest.main()