[TemRevil]

Fixes #1510.

Problem

configureGitAuth() removes the credential that actions/checkout persists with:

git config --unset-all http.<server>/.extraheader

That edits only the repo-local config. Since actions/checkout v6.0.0 (#2286, backported to v5.0.1 / v4.3.1) the auth header is no longer stored in .git/config — it's written to a separate file under RUNNER_TEMP and pulled in via include.path. git config --unset-all cannot remove an include-provided value, so the call is a no-op: the action logs No existing authentication headers to remove while the checkout credential (typically the workflow GITHUB_TOKEN) stays usable by git for the rest of the job — exactly while Claude executes.

Fix

Clear the header from the local config and from every file referenced by include.path, so it's neutralized under both layouts:

• pre-v6 (header in local config) → --unset-all on the local config (unchanged);
• v6+ (header in an included file) → git config --file <inc> --unset-all … on each include.

Includes that don't define the header are left untouched (a no-op --unset-all there), so legitimate includes survive.

Verification

Reproduced the include-based layout with plain git and confirmed the behavior, since git operations aren't unit-tested in this repo (integration lives in install-test):

Case	Before	After fix
v6+ credential behind include.path	--unset-all exits 5, header still resolves	header gone
pre-v6 credential in local config	removed	removed (unchanged)
legit include (no header) present	—	preserved (include kept, its settings intact)
mixed cred-include + legit-include	—	cred gone, legit preserved
no auth configured at all	—	no error (idempotent)

bun run typecheck clean; touched file is prettier-clean. (The repo-wide format:check only flags files due to a Windows CRLF checkout, not this change.)

[TemRevil]

Rebased onto main, the conflict was from #1597 which refactored this function for an unrelated commit-signing case. Fix is reapplied on top of the refactor, typecheck and the git-config tests pass (except the one pre-existing Windows file-mode assertion, confirmed unrelated by reproducing it against a clean upstream checkout).

[TemRevil]

@ashwin-ant this got approved on the 14th but looks like it never went in with the rest of that batch. Anything you need from me? Can rebase if it has drifted.

[TemRevil]

Thanks @ashwin-ant, appreciate it.