Find Which Git Proxy Configuration the Build Actually Reads
Inspect configuration origins in the build's launch context, then select an approved global file explicitly when a changed HOME should not choose it.
Run the inspection in the same environment that the build tool gives Git:
git config --show-origin --get-regexp '^http[.].*proxy$'Compare origins as well as values, keeping credential-bearing output private. A build that changes HOME can move Git's user-config lookup away from the terminal's working setup. XDG_CONFIG_HOME also participates in normal user configuration discovery.
If the intended policy is a fixed approved global file, select it for that launch:
GIT_CONFIG_GLOBAL=/path/to/build.gitconfig git fetchThis changes the global-file input, not system, repository or command-level settings. For an indirect Git launch, pass the variable through the build tool's supported child-environment interface.
That explicit file can hold the required proxy and URL rules without copying private settings into an accidental home directory. Confirm the repository transport too: HTTP proxy configuration does not supply the route for an SSH URL.