Fix RedactURL: check SCP-like URLs before url.Parse

URLs like oauth2:token@host:path were being misinterpreted as having
scheme 'oauth2'. Check SCP regex first, and also require parsed.Host
to be non-empty for standard URL handling.

Author: bjornrobertsson

git/git.go

@@ -473,10 +473,21 @@ func SameHost(url1, url2 string) bool {
 //   - Various schemes: http, https, ssh, git, ftp, sftp
 //   - IPv6 hosts: https://user@[2001:db8::1]/path
 func RedactURL(u string) string {
-	// First, try to parse as a standard URL (handles most schemes)
+	// Handle SCP-like URLs first: user@host:path (no scheme)
+	// Must check this BEFORE url.Parse because urls like "oauth2:token@host:path"
+	// get misinterpreted as having scheme "oauth2".
+	// This catches: git@github.com:org/repo, deploy@host:repo, oauth2:token@gitlab.com:org/repo
+	if matches := scpLikeURLRegex.FindStringSubmatch(u); matches != nil {
+		// matches[1] = user part (could be git, deploy, oauth2:token, etc.)
+		// matches[2] = host
+		// matches[3] = path
+		return "***@" + matches[2] + ":" + matches[3]
+	}
+
+	// Try to parse as a standard URL (handles most schemes)
 	parsed, err := url.Parse(u)
-	if err == nil && parsed.Scheme != "" {
-		// Successfully parsed as a URL with a scheme
+	if err == nil && parsed.Scheme != "" && parsed.Host != "" {
+		// Successfully parsed as a URL with a scheme and host
 		// Redact userinfo if present (handles user, user:pass, token, URL-encoded creds)
 		if parsed.User != nil {
 			// Build URL manually to avoid url.User encoding *** as %2A%2A%2A
@@ -492,15 +503,6 @@ func RedactURL(u string) string {
 		return parsed.String()
 	}
 
-	// Handle SCP-like URLs: user@host:path (no scheme)
-	// This catches: git@github.com:org/repo, deploy@host:repo, user@10.0.0.5:project
-	if matches := scpLikeURLRegex.FindStringSubmatch(u); matches != nil {
-		// matches[1] = user part (could be git, deploy, token, etc.)
-		// matches[2] = host
-		// matches[3] = path
-		return "***@" + matches[2] + ":" + matches[3]
-	}
-
 	// If we can't parse it and it's not SCP-like, return as-is
 	// (probably not a URL with credentials)
 	return u