v0.84.4: checkout@v7 includeIf credential still causes duplicate Authorization headers

[bryanchen-d]

Summary

Fork-backed Git operations still cannot override credentials persisted by actions/checkout@v7. gh-aw v0.84.4 includes the all-scope cleanup from #49059, but checkout v7 stores its header in a separate git-credentials-<uuid>.config file referenced by a repository-local includeIf.gitdir entry. Clearing only --global and --local values does not clear that included value.

Versions

• gh-aw / github/gh-aw-actions/setup: v0.84.4 (4f46189e0dfaf63988118c40003c30652d562906)
• actions/checkout: v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1)
• GitHub-hosted ubuntu-slim

Reproduction

A bounded shim:

1. Checks out microsoft/vscode with checkout v7 and persisted credentials.
2. Mints a separate App installation token for a fork.
3. Calls v0.84.4's released withGitHubHostToken(token, callback, checkoutCwd).
4. Counts effective values for http.https://github.com/.extraheader before, during, and after the callback without printing values.

Run: https://github.com/microsoft/vscode-engineering/actions/runs/30939463258

Observed:

Extraheader count before override: 1
git_auth_helpers: read 1 existing extraheader value(s) for https://github.com
git_auth_helpers: overriding http.https://github.com/.extraheader with CI trigger token
Extraheader count during override: 2
git_auth_helpers: restoring 1 previous extraheader value(s)
Extraheader count after restore: 2
Error: Extraheader count changed from 1 to 2

A preceding run allowed ls-remote to execute and it failed with exit code 128 at the same point: https://github.com/microsoft/vscode-engineering/actions/runs/30939247858

Existing production driver runs show GitHub's exact response:

remote: Duplicate header: "Authorization"
fatal: unable to access 'https://github.com/vscodebot-pr/vscode.git/': The requested URL returned error: 400

Example: https://github.com/microsoft/vscode-engineering/actions/runs/30931907652

No disposable branch was created; both test refs were independently verified absent after the runs.

Root cause

actions/checkout@v7 writes the token header to $RUNNER_TEMP/git-credentials-<uuid>.config and adds repository-local includeIf.gitdir:<checkout>/.git.path entries. unsetExtraheaderAllScopes removes direct global/local values, but the included credential remains effective. The helper then writes the fork header locally, yielding two active values. Restore removes the fork header but writes the previously read included value locally, leaving two copies.

Relevant checkout v7 behavior is in src/git-auth-helper.ts::configureToken; it deliberately creates the credentials file and includeIf entries.

Expected

withGitHubHostToken should expose exactly one effective Authorization header during the callback and restore the checkout credential source without increasing cardinality afterward.

Possible direction

Track config origins, not only values. Temporarily suppress or detach checkout's matching includeIf credential source (with strict path/pattern validation under RUNNER_TEMP) and restore it afterward, or use Git's empty http.extraHeader reset semantics before the temporary Authorization value. Restore must preserve the original origin rather than copying an included value into local config.

Related: #48952, fixed by #49059 for direct global/local values.

[bryanchen-d]

I implemented and validated a candidate fix. This repository's contribution policy/API blocks my account from opening the cross-fork PR (CreatePullRequest permission denied), so the signed branch is ready for a core agent to cherry-pick or recreate:

• Branch: https://github.com/bryanchen-d/gh-aw/tree/copilot/gh-aw/fix-checkout-v7-auth
• Signed commit: bryanchen-d@43f57e9
• Patch: https://github.com/bryanchen-d/gh-aw/commit/43f57e942c69f68c0a3c8e5fdc3cedd685492dda.patch

Implementation

The final design does not mutate global/local config or checkout's includeIf entries:

1. Snapshot the existing GIT_CONFIG_COUNT and the two environment slots that will be appended.
2. Append two highest-priority Git command-scope entries:
   • http.<server>/.extraheader = "" (Git's documented inherited-header reset)
   • http.<server>/.extraheader = Authorization: basic <fork credential>
3. Mask the derived Base64 credential with core.setSecret.
4. Run the callback; all child Git processes inherit exactly one effective Authorization header.
5. Restore/delete only the environment variables changed by the override, with GIT_CONFIG_COUNT restored last.

This preserves every file-backed origin and ordering, supports existing environment config and nested overrides, and avoids the destructive-read/restore risks of editing includeIf entries.

Regression coverage

• Real Git config with checkout-v7 git-credentials-<uuid>.config + includeIf.gitdir
• Local HTTP server inspects raw request headers and proves exactly one fork Authorization header is sent on wire
• Repeated and nested overrides
• Callback failure restoration
• Existing GIT_CONFIG_* preservation and invalid count rejection
• Direct + included credentials and unrelated GHES include
• Caller tests for extra_empty_commit and fork push/ls-remote

Validation:

• npm run typecheck
• Auth/helper/caller tests: 77 passed
• Targeted fork-push caller tests: 6 passed
• Scoped Prettier check and git diff --check

The implementation commit includes Fixes #50362 so a cherry-pick will retain issue linkage.