patch-series: do accept GitGitGadget's push token explicitly

This completes the journey where the token is specified explicitly.

If you (like I did, when developing this patch) wonder how it worked
before: The Azure Pipelines set the `publishRemote` to a URL that
contains the token (which is also the reason why we need stunts like the
`redactGitHubToken()` method).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

lib/gitgitgadget.ts

@@ -284,6 +284,7 @@ export class GitGitGadget {
             this.publishTagsAndNotesToRemote,
             pr.pullRequestURL,
             new Date(),
+            this.publishToken,
         );
         if (!options.noUpdate) {
             await this.pushNotesRef();

lib/patch-series.ts

@@ -555,6 +555,7 @@ export class PatchSeries {
         publishTagsAndNotesToRemote?: string,
         pullRequestURL?: string,
         forceDate?: Date,
+        publishToken?: string,
     ): Promise<IPatchSeriesMetadata | undefined> {
         let globalOptions: IGitGitGadgetOptions | undefined;
         if (this.options.dryRun) {
@@ -822,8 +823,20 @@ export class PatchSeries {
             if (this.options.dryRun) {
                 logger.log("Would publish tag");
             } else {
+                const auth = [];
+                if (publishToken) {
+                    auth.push(
+                        "-c",
+                        [
+                            `http.extraheader=Authorization:`,
+                            `Basic`,
+                            Buffer.from(`x-access-token:${publishToken}`).toString("base64"),
+                        ].join(" "),
+                    );
+                }
+
                 logger.log("Publishing tag");
-                await git(["push", publishTagsAndNotesToRemote, `refs/tags/${tagName}`], {
+                await git([...auth, "push", publishTagsAndNotesToRemote, `refs/tags/${tagName}`], {
                     workDir: this.notes.workDir,
                 });
             }