support ls-remote, and git+ssh protocol

.github/workflows/go.yml

@@ -23,3 +23,10 @@ jobs:
 
     - name: Test
       run: go test -v ./...
+
+  integration-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Integration test
+        run: docker build -f test/Dockerfile .

.gitignore

@@ -0,0 +1 @@
+git

main.go

@@ -41,7 +41,7 @@ func main() {
 	}
 }
 
-var allowedCommands = []string{"clone", "fetch"}
+var allowedCommands = []string{"clone", "fetch", "ls-remote"}
 
 // IsRewriteAllowed returns true if it is safe to rewrite arguments. Some commands
 // such as config would break if rewritten, like when using insteadOf.
@@ -89,7 +89,7 @@ func FindGit(envPath string) string {
 }
 
 var scpUrl = regexp.MustCompile(`^(?P<user>\S+?)@(?P<host>[a-zA-Z\d-]+(\.[a-zA-Z\d-]+)+\.?):(?P<path>.*?/.*?)$`)
-var allowedSchemes = []string{"git", "ssh"}
+var allowedSchemes = []string{"git", "ssh", "git+ssh"}
 
 // Scrub rewrites arguments that look like URLs to have the HTTPS protocol.
 func Scrub(argument string) string {

main_test.go

@@ -19,6 +19,10 @@ func TestIsRewriteAllowed(t *testing.T) {
 			input:    []string{"fetch", ""},
 			expected: true,
 		},
+		{
+			input:    []string{"ls-remote", ""},
+			expected: true,
+		},
 		{
 			input:    []string{"--work-tree=/work", "clone"},
 			expected: true,
@@ -51,6 +55,14 @@ func TestScrub(t *testing.T) {
 			input:    "[email protected]:dependabot/git-https-shim",
 			expected: "https://github.com/dependabot/git-https-shim",
 		},
+		{
+			input:    "git+ssh://[email protected]/dependabot/git-https-shim",
+			expected: "https://github.com/dependabot/git-https-shim",
+		},
+		{
+			input:    "git+ssh://user:[email protected]/dependabot/git-https-shim",
+			expected: "https://user:[email protected]/dependabot/git-https-shim",
+		},
 		{
 			input:    "ssh://user:[email protected]/dependabot/git-https-shim",
 			expected: "https://user:[email protected]/dependabot/git-https-shim",