Added comprehensive Gerrit HTTP authentication support

.gitignore

@@ -163,4 +163,7 @@ dist
 .sourcebot
 /bin
 /config.json
-.DS_Store
+.DS_Store
+
+# Claude Code generated files
+CLAUDE.md

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added comprehensive Gerrit HTTP authentication support with username/password credentials via secrets and environment variables. [#366](https://github.com/sourcebot-dev/sourcebot/pull/366)
+
 ## [4.7.0] - 2025-09-17
 
 ### Added

docs/docs/connections/gerrit.mdx

@@ -6,74 +6,165 @@ icon: crow
 
 import GerritSchema from '/snippets/schemas/v3/gerrit.schema.mdx'
 
-<Note>Authenticating with Gerrit is currently not supported. If you need this capability, please raise a [feature request](https://github.com/sourcebot-dev/sourcebot/issues/new?template=feature_request.md).</Note>
+Sourcebot can sync code from self-hosted Gerrit instances, including both public and authenticated repositories.
 
-Sourcebot can sync code from self-hosted gerrit instances.
+## Authentication Support
+
+<Info>
+**Authentication Status**: Gerrit authentication is supported through HTTP Basic Auth using username and HTTP password credentials. This guide documents the verified authentication methods and implementation details.
+</Info>
+
+### Authentication Methods
+
+Gerrit supports these authentication methods with Sourcebot:
+
+1. **Public Access**: For publicly accessible projects (no authentication required)
+2. **HTTP Basic Auth**: Using Gerrit username and HTTP password
 
 If you're not familiar with Sourcebot [connections](/docs/connections/overview), please read that overview first.
 
 ## Connecting to a Gerrit instance
 
-To connect to a gerrit instance, provide the `url` property to your config:
+### Basic Connection (Public Projects)
+
+For publicly accessible Gerrit projects:
+
+```json
+{
+    "type": "gerrit",
+    "url": "https://gerrit.example.com",
+    "projects": ["public-project-name"]
+}
+```
+
+### Authenticated Connection
+
+For private/authenticated Gerrit projects, you need to provide credentials:
 
 ```json
 {
     "type": "gerrit",
-    "url": "https://gerrit.example.com"
-    // .. rest of config ..
+    "url": "https://gerrit.example.com",
+    "projects": ["private-project-name"],
+    "auth": {
+        "username": "your-gerrit-username",
+        "password": {
+            "env": "GERRIT_HTTP_PASSWORD"
+        }
+    }
 }
 ```
 
+<Warning>
+Use **HTTP Password**, not your Gerrit account password. Generate an HTTP password in Gerrit: **Settings → HTTP Credentials → Generate Password**.
+</Warning>
+
+Set your Gerrit HTTP password as an environment variable:
+
+```bash
+export GERRIT_HTTP_PASSWORD="your-generated-http-password"
+```
+
+When running with Docker:
+
+```bash
+docker run -e GERRIT_HTTP_PASSWORD="your-http-password" ...
+```
+
+## Authentication Setup
+
+### Generate HTTP Password
+
+1. Log into your Gerrit instance
+2. Go to **Settings** → **HTTP Credentials** → **Generate Password**
+3. Copy the generated password (this is your HTTP password)
+
+<Note>
+**Special Characters**: If your HTTP password contains special characters like `/`, `+`, or `=`, Sourcebot automatically handles URL encoding for git operations.
+</Note>
+
 ## Examples
 
 <AccordionGroup>
+    <Accordion title="Public Gerrit instance">
+        ```json
+        {
+            "type": "gerrit",
+            "url": "https://gerrit.googlesource.com",
+            "projects": ["android/platform/build"]
+        }
+        ```
+    </Accordion>
+
+    <Accordion title="Private Gerrit with authentication">
+        ```json
+        {
+            "type": "gerrit",
+            "url": "https://gerrit.company.com",
+            "projects": ["internal-project"],
+            "auth": {
+                "username": "john.doe",
+                "password": {
+                    "env": "GERRIT_HTTP_PASSWORD"
+                }
+            }
+        }
+        ```
+    </Accordion>
+
     <Accordion title="Sync projects by glob pattern">
         ```json
         {
             "type": "gerrit",
             "url": "https://gerrit.example.com",
-            // Sync all repos under project1 and project2/sub-project
             "projects": [
                 "project1/**",
                 "project2/sub-project/**"
-            ]
+            ],
+            "auth": {
+                "username": "your-username",
+                "password": {
+                    "env": "GERRIT_HTTP_PASSWORD"
+                }
+            }
         }
         ```
     </Accordion>
+
     <Accordion title="Exclude repos from syncing">
         ```json
         {
             "type": "gerrit",
             "url": "https://gerrit.example.com",
-            // Sync all repos under project1 and project2/sub-project...
             "projects": [
                 "project1/**",
                 "project2/sub-project/**"
             ],
-            // ...except:
             "exclude": {
-                // any project that matches these glob patterns
                 "projects": [
                     "project1/foo-project",
                     "project2/sub-project/some-sub-folder/**"
                 ],
-
-                // projects that have state READ_ONLY
                 "readOnly": true,
-
-                // projects that have state HIDDEN
                 "hidden": true
+            },
+            "auth": {
+                "username": "your-username",
+                "password": {
+                    "env": "GERRIT_HTTP_PASSWORD"
+                }
             }
         }
         ```
     </Accordion>
 </AccordionGroup>
 
-## Schema reference
+## Schema Reference
 
 <Accordion title="Reference">
 [schemas/v3/gerrit.json](https://github.com/sourcebot-dev/sourcebot/blob/main/schemas/v3/gerrit.json)
 
 <GerritSchema />
 
-</Accordion>
+</Accordion>
+

docs/snippets/schemas/v3/azuredevops.schema.mdx

@@ -22,6 +22,7 @@
           "properties": {
             "secret": {
               "type": "string",
+              "minLength": 1,
               "description": "The name of the secret that contains the token."
             }
           },
@@ -35,6 +36,7 @@
           "properties": {
             "env": {
               "type": "string",
+              "minLength": 1,
               "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
             }
           },

docs/snippets/schemas/v3/bitbucket.schema.mdx

@@ -26,6 +26,7 @@
           "properties": {
             "secret": {
               "type": "string",
+              "minLength": 1,
               "description": "The name of the secret that contains the token."
             }
           },
@@ -39,6 +40,7 @@
           "properties": {
             "env": {
               "type": "string",
+              "minLength": 1,
               "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
             }
           },

docs/snippets/schemas/v3/connection.schema.mdx

@@ -26,6 +26,7 @@
               "properties": {
                 "secret": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the secret that contains the token."
                 }
               },
@@ -39,6 +40,7 @@
               "properties": {
                 "env": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
                 }
               },
@@ -239,6 +241,7 @@
               "properties": {
                 "secret": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the secret that contains the token."
                 }
               },
@@ -252,6 +255,7 @@
               "properties": {
                 "env": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
                 }
               },
@@ -446,6 +450,7 @@
               "properties": {
                 "secret": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the secret that contains the token."
                 }
               },
@@ -459,6 +464,7 @@
               "properties": {
                 "env": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
                 }
               },
@@ -602,6 +608,65 @@
           ],
           "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
         },
+        "auth": {
+          "type": "object",
+          "description": "Authentication configuration for Gerrit",
+          "properties": {
+            "username": {
+              "type": "string",
+              "description": "Gerrit username for authentication",
+              "examples": [
+                "john.doe"
+              ]
+            },
+            "password": {
+              "description": "Gerrit HTTP password (not your account password). Generate this in Gerrit → Settings → HTTP Credentials → Generate Password. Note: HTTP password authentication requires Gerrit's auth.gitBasicAuthPolicy to be set to HTTP or HTTP_LDAP.",
+              "examples": [
+                {
+                  "env": "GERRIT_HTTP_PASSWORD"
+                },
+                {
+                  "secret": "GERRIT_PASSWORD_SECRET"
+                }
+              ],
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "secret": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "The name of the secret that contains the token."
+                    }
+                  },
+                  "required": [
+                    "secret"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "env": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
+                    }
+                  },
+                  "required": [
+                    "env"
+                  ],
+                  "additionalProperties": false
+                }
+              ]
+            }
+          },
+          "required": [
+            "username",
+            "password"
+          ],
+          "additionalProperties": false
+        },
         "projects": {
           "type": "array",
           "items": {
@@ -718,6 +783,7 @@
               "properties": {
                 "secret": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the secret that contains the token."
                 }
               },
@@ -731,6 +797,7 @@
               "properties": {
                 "env": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
                 }
               },
@@ -891,6 +958,7 @@
               "properties": {
                 "secret": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the secret that contains the token."
                 }
               },
@@ -904,6 +972,7 @@
               "properties": {
                 "env": {
                   "type": "string",
+                  "minLength": 1,
                   "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
                 }
               },