feat: add Rundeck Runner support, repo-named subdirectories, and SSH key cleanup

[elioe]

Summary

• Add ProxyRunnerPlugin and ProxySecretBundleCreator for secure distributed execution via Rundeck Runners.
• Add gitUseRepoNameSubdirectory option to clone under a subdirectory named after the Git repository.
• Fix SSH resource leak: PluginSshSessionFactory now implements Closeable; all callers close the factory in a finally block.
• Add git reset --hard + git clean before pull to prevent failures from dirty working tree.
• Fix performPush always logging "Push is not successful" — now checks actual RemoteRefUpdate statuses.
• Fix UP_TO_DATE being treated as a push failure.
• Fix path traversal in extractRepoName: reject ., .., and names containing path separators.
• Fix lost stack trace in prepareSecretBundleForStep error logging.
• Add Spock unit tests for secret bundling and repo name extraction.

Test plan

• Verify extractRepoName returns null for ., .., and names with / or \
• Verify SSH key temp files are deleted after clone/pull/push operations
• Verify push no longer logs false failures when remote is already up-to-date
• Run existing Spock test suite

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR extends the Rundeck Git plugin to better support distributed execution via Rundeck Runners (including secret bundling), improves repo checkout directory layout (optional repo-name subdirectory), and addresses SSH session/key cleanup by making PluginSshSessionFactory closeable and ensuring callers close it.

Changes:

• Add Proxy Runner support for workflow steps by implementing ProxyRunnerPlugin / ProxySecretBundleCreator and introducing server-side secret bundling utilities.
• Add gitUseRepoNameSubdirectory option and URL-to-repo-name extraction with path traversal protections.
• Fix SSH session/key resource lifecycle by making PluginSshSessionFactory reusable + closeable and closing it in GitManager operations; add reset/clean before pull and improve push result handling logic.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/main/groovy/com/rundeck/plugin/util/GitPluginUtil.groovy	Adds repo-name extraction and secret-path/bundle helpers for Runner execution.
src/main/groovy/com/rundeck/plugin/util/PluginSshSessionFactory.groovy	Makes SSH session factory closeable; adds temp key deletion and factory reuse.
src/main/groovy/com/rundeck/plugin/GitManager.groovy	Ensures SSH factories are closed; resets/cleans before pull; improves push status evaluation.
src/main/groovy/com/rundeck/plugin/GitCloneWorkflowStep.groovy	Adds Runner secret interfaces, repo-name subdir option, and secret bundle/path methods.
src/main/groovy/com/rundeck/plugin/GitCommitWorkflowStep.groovy	Adds Runner secret interfaces, repo-name subdir option, and secret bundle/path methods.
src/main/groovy/com/rundeck/plugin/GitPushWorkflowStep.groovy	Adds Runner secret interfaces, repo-name subdir option, and secret bundle/path methods.
src/test/groovy/com/rundeck/plugin/WorkflowStepSecretBundleSpec.groovy	New tests verifying workflow steps implement Runner secret interfaces and bundle paths/values.
src/test/groovy/com/rundeck/plugin/util/PluginSshSessionFactorySpec.groovy	Updates/adds tests for factory reuse, idempotent close, and temp key deletion.
src/test/groovy/com/rundeck/plugin/util/GitPluginUtilSecretBundleSpec.groovy	New tests for secret path listing and secret bundle creation behavior.
src/test/groovy/com/rundeck/plugin/util/GitPluginUtilExtractRepoNameSpec.groovy	New tests for Git URL repo-name extraction.

Comments suppressed due to low confidence (1)

src/main/groovy/com/rundeck/plugin/GitManager.groovy:209

• The success-path log message is incorrect: when result.isSuccessful() is true, it currently logs "Pull is not successful.". This makes troubleshooting confusing and also duplicates the failure message.

            if (!result.isSuccessful()) {
                logger.info("Pull is not successful.")
            } else {
                logger.debug("Pull is not successful.")
            }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/main/groovy/com/rundeck/plugin/GitManager.groovy:209

• The success branch logs the same "Pull is not successful." message as the failure branch, which makes pull outcomes misleading in logs. Update the else branch to log a success message (and optionally tweak the failure wording).

            if (!result.isSuccessful()) {
                logger.info("Pull is not successful.")
            } else {
                logger.debug("Pull is not successful.")
            }

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/main/groovy/com/rundeck/plugin/GitManager.groovy:209

• In performPull, the success branch logs "Pull is not successful.", which is misleading and makes it hard to diagnose real pull failures. The else branch should log a success message.

            if (!result.isSuccessful()) {
                logger.info("Pull is not successful.")
            } else {
                logger.debug("Pull is not successful.")
            }