[Tbt-285] netrc sanitize

lib/travis/vcs/git.rb

@@ -92,7 +92,7 @@ def write_netrc
         end
 
         def delete_netrc?
-          !data.keep_netrc?
+          ENV['DELETE_NETRC'] == 'true' || !data.keep_netrc?
         end
 
         def delete_netrc

lib/travis/vcs/git/netrc.rb

@@ -9,7 +9,22 @@ def apply
         end
 
         def delete
-          sh.raw "rm -f ${TRAVIS_HOME}/#{netrc_filename}"
+          host = Shellwords.escape(data.source_host)
+          file_path = "${TRAVIS_HOME}/#{netrc_filename}"
+
+          if netrc_filename == '_netrc'
+            # Windows
+            sh.raw %(
+              powershell -Command "
+                (Get-Content #{file_path}) |
+                  Where-Object { $_ -notmatch 'login|password' } |
+                  Set-Content #{file_path}
+              "
+            )
+          else
+            # Linux/macOS
+            sh.raw "sed -i '/^machine #{host}/,/^$/ { /login/d; /password/d; }' #{file_path}"
+          end
         end
 
         private

spec/build/git_spec.rb

@@ -120,8 +120,12 @@
     context "when keep_netrc is false" do
       before { payload[:keep_netrc] = false }
 
-      it 'deletes .netrc' do
-        should include_sexp [:raw, "rm -f ${TRAVIS_HOME}/.netrc", assert: true]
+      it 'removes credentials from .netrc' do
+        should include_sexp(
+          :raw,
+          %r{^sed -i '/\^machine github\\.com/,/\^\$/ { /login/d; /password/d; }' \$\{TRAVIS_HOME\}/\.netrc$},
+          assert: true
+        )
       end
     end
   end