feat(installer): build worker source over SSH

internal/sshinstall/plan_test.go

@@ -127,7 +127,7 @@ func TestPlanSourceAlpine(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if p.Repo != DefaultRepo || p.Branch != DefaultBranch {
+	if p.Repo != DefaultRepo || p.Branch != "" {
 		t.Fatalf("plan defaults wrong: %+v", p)
 	}
 	if p.Toolchain.Arch != "linux-amd64" {
@@ -230,14 +230,45 @@ func TestPackagePrereqsNeverIncludeCompiler(t *testing.T) {
 }
 
 func TestValidateRepoURLSchemes(t *testing.T) {
-	for _, ok := range []string{"https://rocketgit.ru/rsmon/worker.git", "http://x/y", "git://example.test/r"} {
+	for _, ok := range []string{"https://rocketgit.ru/rsmon/worker.git", "https://example.test/r"} {
 		if err := validateRepoURL(ok); err != nil {
 			t.Fatalf("validateRepoURL(%q): %v", ok, err)
 		}
 	}
-	for _, bad := range []string{"ssh://h@x/r", "s3://bucket/key", "x y", ""} {
+	for _, bad := range []string{
+		"ssh://h@x/r", "s3://bucket/key", "x y", "", "http://x/y", "git://example.test/r",
+		"https://user:pass@example.test/r", "https://token@example.test/r", "file:///tmp/r",
+	} {
 		if err := validateRepoURL(bad); err == nil {
 			t.Fatalf("validateRepoURL(%q) succeeded", bad)
 		}
 	}
 }
+
+func TestPlanSourceRejectsUnsafeCharset(t *testing.T) {
+	ubuntu := Detect("ID=ubuntu\n", nil)
+	for _, goarch := range []string{"amd64;rm", "x;rm -rf", "$(id)", "..", "a b"} {
+		if _, err := PlanSource(ubuntu, SourceOptions{UnameM: "x86_64", GoArch: goarch}); err == nil {
+			t.Fatalf("unsafe GoArch %q planned", goarch)
+		}
+	}
+	for _, version := range []string{"1.26;rm", "$(id)", "1.26.0 x", "a/b"} {
+		if _, err := PlanSource(ubuntu, SourceOptions{UnameM: "x86_64", GoVersion: version}); err == nil {
+			t.Fatalf("unsafe GoVersion %q planned", version)
+		}
+	}
+	if !ValidGoVersion("1.26.0") || !ValidGoArch("amd64") {
+		t.Fatal("valid version/arch rejected")
+	}
+}
+
+func TestPlanSourceEmptyBranchSteps(t *testing.T) {
+	ubuntu := Detect("ID=ubuntu\n", nil)
+	p, err := PlanSource(ubuntu, SourceOptions{UnameM: "x86_64"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(p.Steps()[3].Detail, "remote default branch") {
+		t.Fatalf("checkout step detail for empty branch = %q", p.Steps()[3].Detail)
+	}
+}