Keep repositories on their known public forge (#40542)

* fix(git): keep public forge ownership ahead of auth evidence

* test(git): exercise forge admission with complete auth fixtures

src/main/github/github-enterprise-repository.test.ts

@@ -70,6 +70,24 @@ describe('getEnterpriseGitHubRepoSlug', () => {
     _resetOriginGitHubApiRepositoryCache()
   })
 
+  it.each([
+    ['https://bitbucket.org/team/orca.git', 'bitbucket.org'],
+    ['ssh://git@altssh.gitlab.com:443/team/orca.git', 'altssh.gitlab.com'],
+    ['https://codeberg.org/team/orca.git', 'codeberg.org']
+  ])('does not promote a foreign public remote from gh inventory: %s', async (url, host) => {
+    mockOriginRemote(url)
+    mockHostAuthenticated(host)
+    await expect(getEnterpriseGitHubRepoSlug('/repo')).resolves.toBeFalsy()
+    await expect(isGitHubHostAuthenticated(host, '/repo')).resolves.toBe(false)
+  })
+
+  it('uses the effective SSH hostname before admitting an Enterprise identity', async () => {
+    mockOriginRemote('git@work-forge:team/orca.git')
+    resolveWithSshGMock.mockResolvedValue({ hostname: 'bitbucket.org' })
+    mockHostAuthenticated('bitbucket.org')
+    await expect(getEnterpriseGitHubRepoSlug('/repo')).resolves.toBeNull()
+  })
+
   it.each([
     'https://ghe.acme.com:8443/team/orca.git',
     'https://ghe.acme.com:80/team/orca.git',

src/main/github/github-enterprise-repository.ts

@@ -22,6 +22,7 @@ import { parseWslPath } from '../wsl/filesystem/unc-path-access'
 import { isStableMissingGitRemoteError } from '../git/remotes/stable-missing-git-remote-error'
 import { requireReachableGitRoute } from '../providers/execution-host-provider-dispatch'
 import { getConnectionExecutionHostId } from '../../shared/execution-host'
+import { getPublicForgeProviderForHost } from '../../shared/git/remotes/public-forge-host'
 
 export type GitHubEnterpriseRepoSlug = GitHubOwnerRepo & { host: string }
 
@@ -131,6 +132,10 @@ async function resolveAuthenticatedGitHubHost(
   connectionId?: string | null,
   localGitOptions: LocalGitExecOptions = {}
 ): Promise<string | null | undefined> {
+  const owner = getPublicForgeProviderForHost(host)
+  if (owner && owner !== 'github') {
+    return null
+  }
   const normalizedHost = normalizeGitHubHost(host)?.authority ?? host.trim().toLowerCase()
   const execOptions = ghRepoExecOptions(githubRepoContext(repoPath, connectionId, localGitOptions))
   const cacheKey = `${runtimeCacheKey(repoPath, connectionId, localGitOptions.wslDistro)}\0${normalizedHost}\0${githubReadExecutionScope(execOptions)}`