.

.github/workflows/test.yml

@@ -299,7 +299,7 @@ jobs:
   test-output:
     runs-on: ubuntu-latest
     steps:
-      # Download the action at the current ref
+      # Clone this repo
       - name: Checkout
         uses: actions/checkout@v4.1.6
         with:

__test__/git-auth-helper.test.ts

@@ -769,19 +769,43 @@ describe('git-auth-helper tests', () => {
     // Arrange
     await setup(testCredentialsConfigPath_matchesCredentialsConfigPaths)
     const authHelper = gitAuthHelper.createAuthHelper(git, settings)
-    
+
     // Get a real credentials config path
-    const credentialsConfigPath = await (authHelper as any).getCredentialsConfigPath()
-    
+    const credentialsConfigPath = await (
+      authHelper as any
+    ).getCredentialsConfigPath()
+
     // Act & Assert
-    expect((authHelper as any).testCredentialsConfigPath(credentialsConfigPath)).toBe(true)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-12345678-abcd-1234-5678-123456789012.config')).toBe(true)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-abcdef12-3456-7890-abcd-ef1234567890.config')).toBe(true)
-    
+    expect(
+      (authHelper as any).testCredentialsConfigPath(credentialsConfigPath)
+    ).toBe(true)
+    expect(
+      (authHelper as any).testCredentialsConfigPath(
+        '/some/path/git-credentials-12345678-abcd-1234-5678-123456789012.config'
+      )
+    ).toBe(true)
+    expect(
+      (authHelper as any).testCredentialsConfigPath(
+        '/some/path/git-credentials-abcdef12-3456-7890-abcd-ef1234567890.config'
+      )
+    ).toBe(true)
+
     // Test invalid paths
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/other-config.config')).toBe(false)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-invalid.config')).toBe(false)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-.config')).toBe(false)
+    expect(
+      (authHelper as any).testCredentialsConfigPath(
+        '/some/path/other-config.config'
+      )
+    ).toBe(false)
+    expect(
+      (authHelper as any).testCredentialsConfigPath(
+        '/some/path/git-credentials-invalid.config'
+      )
+    ).toBe(false)
+    expect(
+      (authHelper as any).testCredentialsConfigPath(
+        '/some/path/git-credentials-.config'
+      )
+    ).toBe(false)
     expect((authHelper as any).testCredentialsConfigPath('')).toBe(false)
   })
 })
@@ -890,7 +914,11 @@ async function setup(testName: string): Promise<void> {
       }
     ),
     tryConfigUnsetValue: jest.fn(
-      async (key: string, value: string, globalConfig?: boolean): Promise<boolean> => {
+      async (
+        key: string,
+        value: string,
+        globalConfig?: boolean
+      ): Promise<boolean> => {
         const configPath = globalConfig
           ? path.join(git.env['HOME'] || tempHomedir, '.gitconfig')
           : localGitConfigPath

__test__/verify-submodules-recursive.sh

@@ -17,10 +17,23 @@ fi
 
 echo "Testing persisted credential"
 pushd ./submodules-recursive/submodule-level-1/submodule-level-2
-git config --local --name-only --get-regexp http.+extraheader && git fetch
+
+# Check if credentials are configured
+echo "Testing for extraheader in git config"
+git config list | grep -q "http.*extraheader"
 if [ "$?" != "0" ]; then
-    echo "Failed to validate persisted credential"
+    echo "Failed to validate persisted credential - no http extraheader found"
     popd
     exit 1
 fi
+
+# Try to ls-remote to validate credentials work
+echo "Testing git ls-remote to validate credentials"
+git ls-remote origin >/dev/null
+if [ "$?" != "0" ]; then
+    echo "Failed to validate persisted credential - git ls-remote failed"
+    popd
+    exit 1
+fi
+
 popd

__test__/verify-submodules-true.sh

@@ -17,10 +17,11 @@ fi
 
 echo "Testing persisted credential"
 pushd ./submodules-true/submodule-level-1
-git config --local --name-only --get-regexp http.+extraheader && git fetch
+git config --local --includes --name-only --get-regexp http.+extraheader && git fetch
 if [ "$?" != "0" ]; then
     echo "Failed to validate persisted credential"
     popd
     exit 1
 fi
-popd
+
+popd

dist/index.js

@@ -255,17 +255,10 @@ class GitAuthHelper {
             // Remove possible previous HTTPS instead of SSH
             yield this.removeSubmoduleGitConfig(this.insteadOfKey);
             if (this.settings.persistCredentials) {
-                // Credentials config path
-                const credentialsConfigPath = yield this.getCredentialsConfigPath();
+                // Get the credentials config file path in RUNNER_TEMP
+                const credentialsConfigPath = this.getCredentialsConfigPath();
                 // Container credentials config path
                 const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
-                // Container repo path
-                const workingDirectory = this.git.getWorkingDirectory();
-                const githubWorkspace = process.env['GITHUB_WORKSPACE'];
-                assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
-                let relativePath = path.relative(githubWorkspace, workingDirectory);
-                relativePath = relativePath.replace(/\\/g, '/');
-                const containerRepoPath = path.posix.join('/github/workspace', relativePath);
                 // Get submodule config file paths.
                 const configPaths = yield this.git.getSubmoduleConfigPaths(this.settings.nestedSubmodules);
                 // For each submodule, configure includeIf entries pointing to the shared credentials file.
@@ -276,10 +269,13 @@ class GitAuthHelper {
                     submoduleGitDir = submoduleGitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                     // Configure host includeIf
                     yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, false, configPath);
-                    // Configure container includeIf
+                    // Container submodule git directory
+                    const githubWorkspace = process.env['GITHUB_WORKSPACE'];
+                    assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
                     let relativeSubmoduleGitDir = path.relative(githubWorkspace, submoduleGitDir);
                     relativeSubmoduleGitDir = relativeSubmoduleGitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                     const containerSubmoduleGitDir = path.posix.join('/github/workspace', relativeSubmoduleGitDir);
+                    // Configure container includeIf
                     yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, false, configPath);
                 }
                 if (this.settings.sshKey) {
@@ -379,7 +375,7 @@ class GitAuthHelper {
     configureToken(globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
             // Get the credentials config file path in RUNNER_TEMP
-            const credentialsConfigPath = yield this.getCredentialsConfigPath();
+            const credentialsConfigPath = this.getCredentialsConfigPath();
             // Write placeholder to the separate credentials config file using git config.
             // This approach avoids the credential being captured by process creation audit events,
             // which are commonly logged. For more information, refer to
@@ -408,9 +404,9 @@ class GitAuthHelper {
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
                 yield this.git.config(hostIncludeKey, credentialsConfigPath);
                 // Container git directory
+                const workingDirectory = this.git.getWorkingDirectory();
                 const githubWorkspace = process.env['GITHUB_WORKSPACE'];
                 assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
-                const workingDirectory = this.git.getWorkingDirectory();
                 let relativePath = path.relative(githubWorkspace, workingDirectory);
                 relativePath = relativePath.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                 const containerGitDir = path.posix.join('/github/workspace', relativePath, '.git');
@@ -427,18 +423,16 @@ class GitAuthHelper {
      * @returns The absolute path to the credentials config file
      */
     getCredentialsConfigPath() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.credentialsConfigPath) {
-                return this.credentialsConfigPath;
-            }
-            const runnerTemp = process.env['RUNNER_TEMP'] || '';
-            assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
-            // Create a unique filename for this checkout instance
-            const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
-            this.credentialsConfigPath = path.join(runnerTemp, configFileName);
-            core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
+        if (this.credentialsConfigPath) {
             return this.credentialsConfigPath;
-        });
+        }
+        const runnerTemp = process.env['RUNNER_TEMP'] || '';
+        assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+        // Create a unique filename for this checkout instance
+        const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
+        this.credentialsConfigPath = path.join(runnerTemp, configFileName);
+        core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
+        return this.credentialsConfigPath;
     }
     /**
      * Removes SSH authentication configuration by cleaning up SSH keys,
@@ -472,7 +466,7 @@ class GitAuthHelper {
                 }
             }
             // SSH command
-            core.info("Removing SSH command configuration");
+            core.info('Removing SSH command configuration');
             yield this.removeGitConfig(SSH_COMMAND_KEY);
             yield this.removeSubmoduleGitConfig(SSH_COMMAND_KEY);
         });
@@ -485,13 +479,13 @@ class GitAuthHelper {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             // Remove HTTP extra header
-            core.info("Removing HTTP extra header");
+            core.info('Removing HTTP extra header');
             yield this.removeGitConfig(this.tokenConfigKey);
             yield this.removeSubmoduleGitConfig(this.tokenConfigKey);
             // Collect credentials config paths that need to be removed
             const credentialsPaths = new Set();
             // Remove includeIf entries that point to git-credentials-*.config files
-            core.info("Removing includeIf entries pointing to credentials config files");
+            core.info('Removing includeIf entries pointing to credentials config files');
             const mainCredentialsPaths = yield this.removeIncludeIfCredentials();
             mainCredentialsPaths.forEach(path => credentialsPaths.add(path));
             // Remove submodule includeIf entries that point to git-credentials-*.config files
@@ -1060,7 +1054,10 @@ class GitCommandManager {
             if (output.exitCode !== 0) {
                 return [];
             }
-            return output.stdout.trim().split('\n').filter(value => value.trim());
+            return output.stdout
+                .trim()
+                .split('\n')
+                .filter(value => value.trim());
         });
     }
     tryGetConfigKeys(pattern, globalConfig, configFile) {
@@ -1077,7 +1074,10 @@ class GitCommandManager {
             if (output.exitCode !== 0) {
                 return [];
             }
-            return output.stdout.trim().split('\n').filter(key => key.trim());
+            return output.stdout
+                .trim()
+                .split('\n')
+                .filter(key => key.trim());
         });
     }
     tryReset() {

src/git-auth-helper.ts

@@ -154,8 +154,8 @@ class GitAuthHelper {
     await this.removeSubmoduleGitConfig(this.insteadOfKey)
 
     if (this.settings.persistCredentials) {
-      // Credentials config path
-      const credentialsConfigPath = await this.getCredentialsConfigPath()
+      // Get the credentials config file path in RUNNER_TEMP
+      const credentialsConfigPath = this.getCredentialsConfigPath()
 
       // Container credentials config path
       const containerCredentialsPath = path.posix.join(
@@ -163,17 +163,6 @@ class GitAuthHelper {
         path.basename(credentialsConfigPath)
       )
 
-      // Container repo path
-      const workingDirectory = this.git.getWorkingDirectory()
-      const githubWorkspace = process.env['GITHUB_WORKSPACE']
-      assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
-      let relativePath = path.relative(githubWorkspace, workingDirectory)
-      relativePath = relativePath.replace(/\\/g, '/')
-      const containerRepoPath = path.posix.join(
-        '/github/workspace',
-        relativePath
-      )
-
       // Get submodule config file paths.
       const configPaths = await this.git.getSubmoduleConfigPaths(
         this.settings.nestedSubmodules
@@ -195,7 +184,9 @@ class GitAuthHelper {
           configPath
         )
 
-        // Configure container includeIf
+        // Container submodule git directory
+        const githubWorkspace = process.env['GITHUB_WORKSPACE']
+        assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
         let relativeSubmoduleGitDir = path.relative(
           githubWorkspace,
           submoduleGitDir
@@ -205,6 +196,8 @@ class GitAuthHelper {
           '/github/workspace',
           relativeSubmoduleGitDir
         )
+
+        // Configure container includeIf
         await this.git.config(
           `includeIf.gitdir:${containerSubmoduleGitDir}.path`,
           containerCredentialsPath,
@@ -327,7 +320,7 @@ class GitAuthHelper {
    */
   private async configureToken(globalConfig?: boolean): Promise<void> {
     // Get the credentials config file path in RUNNER_TEMP
-    const credentialsConfigPath = await this.getCredentialsConfigPath()
+    const credentialsConfigPath = this.getCredentialsConfigPath()
 
     // Write placeholder to the separate credentials config file using git config.
     // This approach avoids the credential being captured by process creation audit events,
@@ -348,7 +341,9 @@ class GitAuthHelper {
       placeholderIndex < 0 ||
       placeholderIndex != content.lastIndexOf(this.tokenPlaceholderConfigValue)
     ) {
-      throw new Error(`Unable to replace auth placeholder in ${credentialsConfigPath}`)
+      throw new Error(
+        `Unable to replace auth placeholder in ${credentialsConfigPath}`
+      )
     }
     assert.ok(this.tokenConfigValue, 'tokenConfigValue is not defined')
     content = content.replace(
@@ -371,9 +366,9 @@ class GitAuthHelper {
       await this.git.config(hostIncludeKey, credentialsConfigPath)
 
       // Container git directory
+      const workingDirectory = this.git.getWorkingDirectory()
       const githubWorkspace = process.env['GITHUB_WORKSPACE']
       assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
-      const workingDirectory = this.git.getWorkingDirectory()
       let relativePath = path.relative(githubWorkspace, workingDirectory)
       relativePath = relativePath.replace(/\\/g, '/') // Use forward slashes, even on Windows
       const containerGitDir = path.posix.join(
@@ -398,7 +393,7 @@ class GitAuthHelper {
    * Gets or creates the path to the credentials config file in RUNNER_TEMP.
    * @returns The absolute path to the credentials config file
    */
-  private async getCredentialsConfigPath(): Promise<string> {
+  private getCredentialsConfigPath(): string {
     if (this.credentialsConfigPath) {
       return this.credentialsConfigPath
     }
@@ -445,7 +440,7 @@ class GitAuthHelper {
     }
 
     // SSH command
-    core.info("Removing SSH command configuration")
+    core.info('Removing SSH command configuration')
     await this.removeGitConfig(SSH_COMMAND_KEY)
     await this.removeSubmoduleGitConfig(SSH_COMMAND_KEY)
   }
@@ -456,7 +451,7 @@ class GitAuthHelper {
    */
   private async removeToken(): Promise<void> {
     // Remove HTTP extra header
-    core.info("Removing HTTP extra header")
+    core.info('Removing HTTP extra header')
     await this.removeGitConfig(this.tokenConfigKey)
     await this.removeSubmoduleGitConfig(this.tokenConfigKey)
 
@@ -464,14 +459,15 @@ class GitAuthHelper {
     const credentialsPaths = new Set<string>()
 
     // Remove includeIf entries that point to git-credentials-*.config files
-    core.info("Removing includeIf entries pointing to credentials config files")
+    core.info('Removing includeIf entries pointing to credentials config files')
     const mainCredentialsPaths = await this.removeIncludeIfCredentials()
     mainCredentialsPaths.forEach(path => credentialsPaths.add(path))
 
     // Remove submodule includeIf entries that point to git-credentials-*.config files
     const submoduleConfigPaths = await this.git.getSubmoduleConfigPaths(true)
     for (const configPath of submoduleConfigPaths) {
-      const submoduleCredentialsPaths = await this.removeIncludeIfCredentials(configPath)
+      const submoduleCredentialsPaths =
+        await this.removeIncludeIfCredentials(configPath)
       submoduleCredentialsPaths.forEach(path => credentialsPaths.add(path))
     }
 
@@ -491,7 +487,9 @@ class GitAuthHelper {
           )
         }
       } else {
-        core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`)
+        core.debug(
+          `Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`
+        )
       }
     }
   }
@@ -528,13 +526,19 @@ class GitAuthHelper {
    * @param configPath Optional path to a specific git config file to operate on
    * @returns Array of unique credentials config file paths that were found and removed
    */
-  private async removeIncludeIfCredentials(configPath?: string): Promise<string[]> {
+  private async removeIncludeIfCredentials(
+    configPath?: string
+  ): Promise<string[]> {
     const credentialsPaths = new Set<string>()
-    
+
     try {
       // Get all includeIf.gitdir keys
-      const keys = await this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, configPath)
-      
+      const keys = await this.git.tryGetConfigKeys(
+        '^includeIf\\.gitdir:',
+        false,
+        configPath
+      )
+
       for (const key of keys) {
         // Get all values for this key
         const values = await this.git.tryGetConfigValues(key, false, configPath)
@@ -556,7 +560,7 @@ class GitAuthHelper {
         core.debug(`Error during includeIf cleanup: ${err}`)
       }
     }
-    
+
     return Array.from(credentialsPaths)
   }
 

src/git-command-manager.ts

@@ -61,11 +61,24 @@ export interface IGitCommandManager {
   tagExists(pattern: string): Promise<boolean>
   tryClean(): Promise<boolean>
   tryConfigUnset(configKey: string, globalConfig?: boolean): Promise<boolean>
-  tryConfigUnsetValue(configKey: string, configValue: string, globalConfig?: boolean, configFile?: string): Promise<boolean>
+  tryConfigUnsetValue(
+    configKey: string,
+    configValue: string,
+    globalConfig?: boolean,
+    configFile?: string
+  ): Promise<boolean>
   tryDisableAutomaticGarbageCollection(): Promise<boolean>
   tryGetFetchUrl(): Promise<string>
-  tryGetConfigValues(configKey: string, globalConfig?: boolean, configFile?: string): Promise<string[]>
-  tryGetConfigKeys(pattern: string, globalConfig?: boolean, configFile?: string): Promise<string[]>
+  tryGetConfigValues(
+    configKey: string,
+    globalConfig?: boolean,
+    configFile?: string
+  ): Promise<string[]>
+  tryGetConfigKeys(
+    pattern: string,
+    globalConfig?: boolean,
+    configFile?: string
+  ): Promise<string[]>
   tryReset(): Promise<boolean>
   version(): Promise<GitVersion>
 }
@@ -494,7 +507,7 @@ class GitCommandManager {
       args.push(globalConfig ? '--global' : '--local')
     }
     args.push('--unset', configKey, configValue)
-    
+
     const output = await this.execGit(args, true)
     return output.exitCode === 0
   }
@@ -537,14 +550,17 @@ class GitCommandManager {
       args.push(globalConfig ? '--global' : '--local')
     }
     args.push('--get-all', configKey)
-    
+
     const output = await this.execGit(args, true)
 
     if (output.exitCode !== 0) {
       return []
     }
 
-    return output.stdout.trim().split('\n').filter(value => value.trim())
+    return output.stdout
+      .trim()
+      .split('\n')
+      .filter(value => value.trim())
   }
 
   async tryGetConfigKeys(
@@ -559,14 +575,17 @@ class GitCommandManager {
       args.push(globalConfig ? '--global' : '--local')
     }
     args.push('--name-only', '--get-regexp', pattern)
-    
+
     const output = await this.execGit(args, true)
 
     if (output.exitCode !== 0) {
       return []
     }
 
-    return output.stdout.trim().split('\n').filter(key => key.trim())
+    return output.stdout
+      .trim()
+      .split('\n')
+      .filter(key => key.trim())
   }
 
   async tryReset(): Promise<boolean> {