fix: authenticate token-based dependency pulls via netrc

Embedding the token in git insteadOf URLs makes Xcode's Swift Package
Manager hang forever during dependency resolution on macOS runners:
SPM asks the keychain for HTTPS credentials (even for public packages)
and the headless keychain prompt can never be answered, see
actions/runner-images#6233

A ~/.netrc file is the documented way to authenticate both git HTTPS
clones (pub get) and xcodebuild/SPM on CI without touching the
keychain. The remaining insteadOf rewrites only map ssh-style URLs to
HTTPS and contain no credentials.

Author: nikzen

.github/actions/dart-prepare/action.yml

@@ -53,12 +53,15 @@ runs:
         chown -R $(whoami) .
         if which flutter > /dev/null; then flutter --disable-analytics; fi
         if which dart > /dev/null; then dart --disable-analytics; fi
-        # --add is required: plain `git config` overwrites the previous value
-        # for the same url base key, leaving only the last insteadOf rewrite.
-        # The rewrites are scoped to the famedly org on purpose: rewriting all
-        # of github.com injects the token into public clones too, which makes
-        # Xcode's Swift Package Manager hang during dependency resolution.
-        git config --global --add url."https://x-access-token:${{ inputs.famedly_github_token }}@github.com/famedly/".insteadOf "https://github.com/famedly/"
-        git config --global --add url."https://x-access-token:${{ inputs.famedly_github_token }}@github.com/famedly/".insteadOf "git@github.com:famedly/"
-        git config --global --add url."https://x-access-token:${{ inputs.famedly_github_token }}@github.com/famedly/".insteadOf "ssh://git@github.com/famedly/"
+        # Authenticate via ~/.netrc instead of embedding the token in git URLs:
+        # git picks it up for HTTPS clones, and Xcode's Swift Package Manager
+        # uses it instead of the macOS keychain. The keychain has no UI on CI
+        # runners, which makes SPM dependency resolution hang forever, see
+        # https://github.com/actions/runner-images/issues/6233
+        printf 'machine github.com\nlogin x-access-token\npassword %s\n\nmachine api.github.com\nlogin x-access-token\npassword %s\n' \
+          "${{ inputs.famedly_github_token }}" "${{ inputs.famedly_github_token }}" > ~/.netrc
+        chmod 600 ~/.netrc
+        # Rewrite ssh-style dependency URLs to HTTPS so the netrc auth applies.
+        git config --global --add url."https://github.com/famedly/".insteadOf "git@github.com:famedly/"
+        git config --global --add url."https://github.com/famedly/".insteadOf "ssh://git@github.com/famedly/"
       shell: bash