Provisioning: count for Connection reference in Validation and Tester

apps/provisioning/pkg/repository/git/repository.go

@@ -101,7 +101,8 @@ func (r *gitRepository) Validate() (list field.ErrorList) {
 	}
 
 	// Readonly repositories may not need a token (if public)
-	if len(r.config.Spec.Workflows) > 0 {
+	// Also, in case a connection is provided, the token will be created by the controller.
+	if len(r.config.Spec.Workflows) > 0 && r.config.Spec.Connection == nil {
 		if cfg.Token == "" && r.config.Secure.Token.IsZero() {
 			list = append(list, field.Required(field.NewPath("secure", "token"), "a git access token is required"))
 		}

apps/provisioning/pkg/repository/git/repository_test.go

@@ -169,6 +169,22 @@ func TestGitRepository_Validate(t *testing.T) {
 			},
 			want: nil,
 		},
+		{
+			name: "missing token for R/W repository with connection",
+			config: &provisioning.Repository{
+				Spec: provisioning.RepositorySpec{
+					Type:       "test_type",
+					Workflows:  []provisioning.Workflow{provisioning.WriteWorkflow},
+					Connection: &provisioning.ConnectionInfo{Name: "my-connection"},
+				},
+			},
+			gitConfig: RepositoryConfig{
+				URL:    "https://git.example.com/repo.git",
+				Branch: "main",
+				Token:  "", // Empty token - should be OK because connection is provided
+			},
+			want: nil,
+		},
 		{
 			name: "unsafe path",
 			config: &provisioning.Repository{