[matt-edmondson]

Fixes #140

What changed

GitLfsCache.Tool/Program.cs defaulted --port to 8080 and then wrote Kestrel:Endpoints:Http:Url = http://*:<port> after every other configuration source. So a port or bind address set in appsettings, a --config file or Kestrel__Endpoints__Http__Url was always overwritten, and the proxy always listened on every interface. GitLfsCache.Service links the same file, so the container image was affected too.

• --port now stays int? all the way into RunAsync.
• A new Program.ApplyListenPort puts the endpoint into the flag overrides, which are layered over configuration like every other flag:
  • when --port is given, http://*:<port>, which wins over configuration;
  • when it isn't and configuration already has a Kestrel:Endpoints section, urls, http_ports or https_ports, nothing, so the configured endpoint is used;
  • otherwise http://*:8080, the same default as before.
• The --port help text now says when the 8080 default applies.

GitBranchStateCache#98 has the same defect. It isn't attached to this run, so it isn't changed here.

Tests

New GitLfsCache.Tests/Tool/PortFlagTests.cs covers the issue's acceptance criteria:

• no flag + configured Kestrel:Endpoints:Http:Url → the configured URL wins
• no flag + urls / http_ports / https_ports / an HTTPS-only endpoint → no HTTP endpoint is forced
• --port 9000 → http://*:9000, even over a configured endpoint
• neither → http://*:8080

To check the tests catch the bug, I temporarily restored the old behaviour (always write http://*:{port ?? 8080}). The two "configured endpoint" tests failed, and they pass with the fix. Full suite: 449 passed, 0 failed.

---

Generated by Claude Code

[matt-edmondson]

SonarCloud Quality Gate: "B Security Rating on New Code"

I can't see which finding this is. The SonarCloud project isn't readable anonymously, and the issues API returns nothing for this PR. The only new non-test code that could plausibly lower the security rating is the endpoint string in Program.ApplyListenPort, $"http://*:{port}". That looks like a match for rule S5332 ("Using clear-text protocols is security-sensitive"). The old line 182 had the same http://*: literal, but this PR moved and rewrote it, so Sonar now counts it as new code.

I haven't changed it, because plain HTTP is deliberate and isn't new behaviour. main already binds http://*:8080, and TLS terminates at the ingress (see the forwarded-headers setup right below). The fix also makes this safer: an operator can now bind to 127.0.0.1 or configure an HTTPS endpoint. Rewording the literal just to get past the scanner would hide the finding without changing anything.

It needs a maintainer's call. Either mark the finding as reviewed/safe in SonarCloud, or tell me you'd prefer a // NOSONAR with that justification, and I'll push it.

All CI test jobs (ubuntu, windows, macos) and CodeQL pass.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud