Choosing Between FetchContent and ExternalProject_Add for Secure Integration Tests

Goal

Run integration tests that require pulling a private repository during CMake configuration without exposing production credentials.

Constraints & Uncertainty

Both FetchContent and ExternalProject_Add can retrieve private sources, but their credential propagation differs: FetchContent relies on the global Git helper or environment variables at configure time, whereas ExternalProject_Add invokes Git in a separate build directory and accepts explicit command‑line options or a temporary credentials file. The trade‑off lies in how each mechanism handles credential persistence, cache reuse, and isolation from the main build tree.

Unresolved Decision

1. Which approach guarantees that temporary tokens are not written to the CMake cache or generated files?
2. Does ExternalProject_Add offer a cleaner way to inject a temporary .netrc or environment variable without altering the global Git configuration?
3. How does FetchContent react to stale source checks when a new token is supplied on subsequent runs?