#!/usr/bin/env bash
# `mise bootstrap --adopt` refuses a URL carrying credentials instead of
# falling back to an ordinary clone that stores the secret in `.git/config`.

url="https://user:TOKEN@example.invalid/me/setup.git"
output="$(quiet_assert_fail "mise bootstrap --adopt $url")"
assert_contains_text "$output" "must not contain credentials"
assert_not_contains_text "$output" "TOKEN"
assert_not_contains "ls -A $MISE_CONFIG_DIR" ".git"
