config: load public cc-ci runtime environment

cc-ci-plan/advisory-scan.py

@@ -1114,19 +1114,24 @@ def markdown(rep: dict) -> str:
 
 
 def _gitea_auth(url: str) -> dict:
-    """Basic auth for the private mirror, from /srv/cc-ci/.testenv.
+    """Basic auth for the private mirror, using public config plus .testenv.
 
     Sent as a HEADER, never embedded in the URL: in-URL credentials leak into shell history, process
     lists and error messages, and urllib mis-parses a password containing a colon."""
     host = re.sub(r"^https?://", "", url).split("/")[0]
     env = {}
-    try:
-        for ln in open(os.environ.get("CCCI_TESTENV", "/srv/cc-ci/.testenv")):
+    for path in (
+        "/srv/cc-ci/cc-ci/.env.public",
+        os.environ.get("CCCI_TESTENV", "/srv/cc-ci/.testenv"),
+    ):
+        try:
+            lines = open(path)
+        except OSError:
+            continue
+        for ln in lines:
             if "=" in ln and not ln.strip().startswith("#"):
                 k, v = ln.strip().split("=", 1)
                 env[k] = v.strip().strip("\"'")
-    except OSError:
-        return {}
     if host != env.get("GITEA_URL", "git.autonomic.zone"):
         return {}
     u, pw = env.get("GITEA_USERNAME"), env.get("GITEA_PASSWORD")