__test__/git-auth-helper.test.ts

@@ -595,15 +595,18 @@ describe('git-auth-helper tests', () => {
       await authHelper.configureSubmoduleAuth()
 
       // Assert
-      // Should configure insteadOf (2 calls for two values)
+      // Should get submodule config paths (1 call) and configure insteadOf (2 calls for two values)
-      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(3)
+      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(4)
       expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
         /unset-all.*insteadOf/
       )
       expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(
-        /url.*insteadOf.*git@github.com:/
+        /show-origin.*remote\.origin\.url/
       )
       expect(mockSubmoduleForeach.mock.calls[2][0]).toMatch(
+        /url.*insteadOf.*git@github.com:/
+      )
+      expect(mockSubmoduleForeach.mock.calls[3][0]).toMatch(
         /url.*insteadOf.*org-123456@github.com:/
       )
     }
@@ -634,12 +637,15 @@ describe('git-auth-helper tests', () => {
       await authHelper.configureSubmoduleAuth()
 
       // Assert
-      // Should configure sshCommand (1 call)
+      // Should get submodule config paths (1 call) and configure sshCommand (1 call)
-      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(2)
+      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(3)
       expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
         /unset-all.*insteadOf/
       )
-      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(/core\.sshCommand/)
+      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(
+        /show-origin.*remote\.origin\.url/
+      )
+      expect(mockSubmoduleForeach.mock.calls[2][0]).toMatch(/core\.sshCommand/)
     }
   )
 
@@ -762,28 +768,6 @@ describe('git-auth-helper tests', () => {
       }
     }
   })
-
-  const testCredentialsConfigPath_matchesCredentialsConfigPaths =
-    'testCredentialsConfigPath matches credentials config paths'
-  it(testCredentialsConfigPath_matchesCredentialsConfigPaths, async () => {
-    // Arrange
-    await setup(testCredentialsConfigPath_matchesCredentialsConfigPaths)
-    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
-    
-    // Get a real credentials config path
-    const credentialsConfigPath = await (authHelper as any).getCredentialsConfigPath()
-    
-    // Act & Assert
-    expect((authHelper as any).testCredentialsConfigPath(credentialsConfigPath)).toBe(true)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-12345678-abcd-1234-5678-123456789012.config')).toBe(true)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-abcdef12-3456-7890-abcd-ef1234567890.config')).toBe(true)
-    
-    // Test invalid paths
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/other-config.config')).toBe(false)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-invalid.config')).toBe(false)
-    expect((authHelper as any).testCredentialsConfigPath('/some/path/git-credentials-.config')).toBe(false)
-    expect((authHelper as any).testCredentialsConfigPath('')).toBe(false)
-  })
 })
 
 async function setup(testName: string): Promise<void> {
@@ -850,7 +834,6 @@ async function setup(testName: string): Promise<void> {
     env: {},
     fetch: jest.fn(),
     getDefaultBranch: jest.fn(),
-    getSubmoduleConfigPaths: jest.fn(async () => []),
     getWorkingDirectory: jest.fn(() => workspace),
     init: jest.fn(),
     isDetached: jest.fn(),

__test__/git-directory-helper.test.ts

@@ -471,7 +471,6 @@ async function setup(testName: string): Promise<void> {
     configExists: jest.fn(),
     fetch: jest.fn(),
     getDefaultBranch: jest.fn(),
-    getSubmoduleConfigPaths: jest.fn(async () => []),
     getWorkingDirectory: jest.fn(() => repositoryPath),
     init: jest.fn(),
     isDetached: jest.fn(),

dist/index.js

@@ -163,6 +163,7 @@ class GitAuthHelper {
         this.sshKnownHostsPath = '';
         this.temporaryHomePath = '';
         this.credentialsConfigPath = ''; // Path to separate credentials config file in RUNNER_TEMP
+        this.credentialsIncludeKeys = []; // Track includeIf config keys for cleanup
         this.git = gitCommandManager;
         this.settings = gitSourceSettings || {};
         // Token auth header
@@ -188,6 +189,20 @@ class GitAuthHelper {
             yield this.configureToken();
         });
     }
+    getCredentialsConfigPath() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.credentialsConfigPath) {
+                return this.credentialsConfigPath;
+            }
+            const runnerTemp = process.env['RUNNER_TEMP'] || '';
+            assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+            // Create a unique filename for this checkout instance
+            const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
+            this.credentialsConfigPath = path.join(runnerTemp, configFileName);
+            core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
+            return this.credentialsConfigPath;
+        });
+    }
     configureTempGlobalConfig() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
@@ -267,7 +282,10 @@ class GitAuthHelper {
                 relativePath = relativePath.replace(/\\/g, '/');
                 const containerRepoPath = path.posix.join('/github/workspace', relativePath);
                 // Get submodule config file paths.
-                const configPaths = yield this.git.getSubmoduleConfigPaths(this.settings.nestedSubmodules);
+                // Use `--show-origin` to get the config file path for each submodule.
+                const output = yield this.git.submoduleForeach(`git config --local --show-origin --name-only --get-regexp remote.origin.url`, this.settings.nestedSubmodules);
+                // Extract config file paths from the output (lines starting with "file:").
+                const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
                 // For each submodule, configure includeIf entries pointing to the shared credentials file.
                 // Configure both host and container paths to support Docker container actions.
                 for (const configPath of configPaths) {
@@ -311,10 +329,6 @@ class GitAuthHelper {
             }
         });
     }
-    /**
-     * Configures SSH authentication by writing the SSH key and known hosts,
-     * and setting up the GIT_SSH_COMMAND environment variable.
-     */
     configureSsh() {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.settings.sshKey) {
@@ -371,11 +385,6 @@ class GitAuthHelper {
             }
         });
     }
-    /**
-     * Configures token-based authentication by creating a credentials config file
-     * and setting up includeIf entries to reference it.
-     * @param globalConfig Whether to configure global config instead of local
-     */
     configureToken(globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
             // Get the credentials config file path in RUNNER_TEMP
@@ -386,15 +395,7 @@ class GitAuthHelper {
             // https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
             yield this.git.config(this.tokenConfigKey, this.tokenPlaceholderConfigValue, false, false, credentialsConfigPath);
             // Replace the placeholder in the credentials config file
-            let content = (yield fs.promises.readFile(credentialsConfigPath)).toString();
+            yield this.replaceTokenPlaceholder(credentialsConfigPath);
-            const placeholderIndex = content.indexOf(this.tokenPlaceholderConfigValue);
-            if (placeholderIndex < 0 ||
-                placeholderIndex != content.lastIndexOf(this.tokenPlaceholderConfigValue)) {
-                throw new Error(`Unable to replace auth placeholder in ${credentialsConfigPath}`);
-            }
-            assert.ok(this.tokenConfigValue, 'tokenConfigValue is not defined');
-            content = content.replace(this.tokenPlaceholderConfigValue, this.tokenConfigValue);
-            yield fs.promises.writeFile(credentialsConfigPath, content);
             // Add include or includeIf to reference the credentials config
             if (globalConfig) {
                 // Global config file is temporary
@@ -407,6 +408,7 @@ class GitAuthHelper {
                 // Configure host includeIf
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
                 yield this.git.config(hostIncludeKey, credentialsConfigPath);
+                this.credentialsIncludeKeys.push(hostIncludeKey);
                 // Container git directory
                 const githubWorkspace = process.env['GITHUB_WORKSPACE'];
                 assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
@@ -419,39 +421,31 @@ class GitAuthHelper {
                 // Configure container includeIf
                 const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`;
                 yield this.git.config(containerIncludeKey, containerCredentialsPath);
+                this.credentialsIncludeKeys.push(containerIncludeKey);
             }
         });
     }
-    /**
+    replaceTokenPlaceholder(configPath) {
-     * Gets or creates the path to the credentials config file in RUNNER_TEMP.
-     * @returns The absolute path to the credentials config file
-     */
-    getCredentialsConfigPath() {
         return __awaiter(this, void 0, void 0, function* () {
-            if (this.credentialsConfigPath) {
+            assert.ok(configPath, 'configPath is not defined');
-                return this.credentialsConfigPath;
+            let content = (yield fs.promises.readFile(configPath)).toString();
+            const placeholderIndex = content.indexOf(this.tokenPlaceholderConfigValue);
+            if (placeholderIndex < 0 ||
+                placeholderIndex != content.lastIndexOf(this.tokenPlaceholderConfigValue)) {
+                throw new Error(`Unable to replace auth placeholder in ${configPath}`);
             }
-            const runnerTemp = process.env['RUNNER_TEMP'] || '';
+            assert.ok(this.tokenConfigValue, 'tokenConfigValue is not defined');
-            assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+            content = content.replace(this.tokenPlaceholderConfigValue, this.tokenConfigValue);
-            // Create a unique filename for this checkout instance
+            yield fs.promises.writeFile(configPath, content);
-            const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
-            this.credentialsConfigPath = path.join(runnerTemp, configFileName);
-            core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
-            return this.credentialsConfigPath;
         });
     }
-    /**
-     * Removes SSH authentication configuration by cleaning up SSH keys,
-     * known hosts files, and SSH command configurations.
-     */
     removeSsh() {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _a;
             // SSH key
             const keyPath = this.sshKeyPath || stateHelper.SshKeyPath;
             if (keyPath) {
                 try {
-                    core.info(`Removing SSH key '${keyPath}'`);
                     yield io.rmRF(keyPath);
                 }
                 catch (err) {
@@ -463,68 +457,60 @@ class GitAuthHelper {
             const knownHostsPath = this.sshKnownHostsPath || stateHelper.SshKnownHostsPath;
             if (knownHostsPath) {
                 try {
-                    core.info(`Removing SSH known hosts '${knownHostsPath}'`);
                     yield io.rmRF(knownHostsPath);
                 }
-                catch (err) {
+                catch (_b) {
-                    core.debug(`${(_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : err}`);
+                    // Intentionally empty
-                    core.warning(`Failed to remove SSH known hosts '${knownHostsPath}'`);
                 }
             }
             // SSH command
-            core.info("Removing SSH command configuration");
             yield this.removeGitConfig(SSH_COMMAND_KEY);
             yield this.removeSubmoduleGitConfig(SSH_COMMAND_KEY);
         });
     }
-    /**
-     * Removes token-based authentication by cleaning up HTTP headers,
-     * includeIf entries, and credentials config files.
-     */
     removeToken() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             // Remove HTTP extra header
-            core.info("Removing HTTP extra header");
             yield this.removeGitConfig(this.tokenConfigKey);
             yield this.removeSubmoduleGitConfig(this.tokenConfigKey);
-            // Collect credentials config paths that need to be removed
-            const credentialsPaths = new Set();
             // Remove includeIf entries that point to git-credentials-*.config files
-            core.info("Removing includeIf entries pointing to credentials config files");
+            // This is more aggressive than tracking keys, but necessary since cleanup
-            const mainCredentialsPaths = yield this.removeIncludeIfCredentials();
+            // runs in a post-step where this.credentialsIncludeKeys is empty
-            mainCredentialsPaths.forEach(path => credentialsPaths.add(path));
+            try {
-            // Remove submodule includeIf entries that point to git-credentials-*.config files
+                // Get all includeIf.gitdir keys
-            const submoduleConfigPaths = yield this.git.getSubmoduleConfigPaths(true);
+                const keys = yield this.git.tryGetConfigKeys('^includeIf\\.gitdir:');
-            for (const configPath of submoduleConfigPaths) {
+                for (const key of keys) {
-                const submoduleCredentialsPaths = yield this.removeIncludeIfCredentials(configPath);
+                    // Get all values for this key
-                submoduleCredentialsPaths.forEach(path => credentialsPaths.add(path));
+                    const values = yield this.git.tryGetConfigValues(key);
-            }
+                    if (values.length > 0) {
-            // Remove credentials config files
+                        // Remove only values that match git-credentials-<uuid>.config pattern
-            for (const credentialsPath of credentialsPaths) {
+                        for (const value of values) {
-                // Only remove credentials config files if they are under RUNNER_TEMP
+                            if (/git-credentials-[0-9a-f-]+\.config$/i.test(value)) {
-                const runnerTemp = process.env['RUNNER_TEMP'];
+                                yield this.git.tryConfigUnsetValue(key, value);
-                assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+                            }
-                if (credentialsPath.startsWith(runnerTemp)) {
+                        }
-                    try {
-                        core.info(`Removing credentials config '${credentialsPath}'`);
-                        yield io.rmRF(credentialsPath);
-                    }
-                    catch (err) {
-                        core.debug(`${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
-                        core.warning(`Failed to remove credentials config '${credentialsPath}'`);
                     }
                 }
-                else {
+            }
-                    core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`);
+            catch (err) {
+                // Ignore errors - this is cleanup code
+                core.debug(`Error during includeIf cleanup: ${err}`);
+            }
+            // Remove submodule includeIf
+            yield this.git.submoduleForeach(`sh -c "git config --local --get-regexp '^includeIf\\.' && git config --local --remove-section includeIf || :"`, true);
+            // Remove credentials config file
+            if (this.credentialsConfigPath) {
+                try {
+                    yield io.rmRF(this.credentialsConfigPath);
+                }
+                catch (err) {
+                    core.debug(`${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                    core.warning(`Failed to remove credentials config '${this.credentialsConfigPath}'`);
                 }
             }
         });
     }
-    /**
-     * Removes a git config key from the local repository config.
-     * @param configKey The git config key to remove
-     */
     removeGitConfig(configKey) {
         return __awaiter(this, void 0, void 0, function* () {
             if ((yield this.git.configExists(configKey)) &&
@@ -534,10 +520,6 @@ class GitAuthHelper {
             }
         });
     }
-    /**
-     * Removes a git config key from all submodule configs.
-     * @param configKey The git config key to remove
-     */
     removeSubmoduleGitConfig(configKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const pattern = regexpHelper.escape(configKey);
@@ -546,51 +528,6 @@ class GitAuthHelper {
             `sh -c "git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :"`, true);
         });
     }
-    /**
-     * Removes includeIf entries that point to git-credentials-*.config files.
-     * @param configPath Optional path to a specific git config file to operate on
-     * @returns Array of unique credentials config file paths that were found and removed
-     */
-    removeIncludeIfCredentials(configPath) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const credentialsPaths = new Set();
-            try {
-                // Get all includeIf.gitdir keys
-                const keys = yield this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, configPath);
-                for (const key of keys) {
-                    // Get all values for this key
-                    const values = yield this.git.tryGetConfigValues(key, false, configPath);
-                    if (values.length > 0) {
-                        // Remove only values that match git-credentials-<uuid>.config pattern
-                        for (const value of values) {
-                            if (this.testCredentialsConfigPath(value)) {
-                                credentialsPaths.add(value);
-                                yield this.git.tryConfigUnsetValue(key, value, false, configPath);
-                            }
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                // Ignore errors - this is cleanup code
-                if (configPath) {
-                    core.debug(`Error during includeIf cleanup for ${configPath}: ${err}`);
-                }
-                else {
-                    core.debug(`Error during includeIf cleanup: ${err}`);
-                }
-            }
-            return Array.from(credentialsPaths);
-        });
-    }
-    /**
-     * Tests if a path matches the git-credentials-*.config pattern.
-     * @param path The path to test
-     * @returns True if the path matches the credentials config pattern
-     */
-    testCredentialsConfigPath(path) {
-        return /git-credentials-[0-9a-f-]+\.config$/i.test(path);
-    }
 }
 
 
@@ -873,16 +810,6 @@ class GitCommandManager {
             throw new Error('Unexpected output when retrieving default branch');
         });
     }
-    getSubmoduleConfigPaths(recursive) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // Get submodule config file paths.
-            // Use `--show-origin` to get the config file path for each submodule.
-            const output = yield this.submoduleForeach(`git config --local --show-origin --name-only --get-regexp remote.origin.url`, recursive);
-            // Extract config file paths from the output (lines starting with "file:").
-            const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
-            return configPaths;
-        });
-    }
     getWorkingDirectory() {
         return this.workingDirectory;
     }
@@ -1013,17 +940,15 @@ class GitCommandManager {
             return output.exitCode === 0;
         });
     }
-    tryConfigUnsetValue(configKey, configValue, globalConfig, configFile) {
+    tryConfigUnsetValue(configKey, configValue, globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
+            const output = yield this.execGit([
-            if (configFile) {
+                'config',
-                args.push('--file', configFile);
+                globalConfig ? '--global' : '--local',
-            }
+                '--unset',
-            else {
+                configKey,
-                args.push(globalConfig ? '--global' : '--local');
+                configValue
-            }
+            ], true);
-            args.push('--unset', configKey, configValue);
-            const output = yield this.execGit(args, true);
             return output.exitCode === 0;
         });
     }
@@ -1046,34 +971,29 @@ class GitCommandManager {
             return stdout;
         });
     }
-    tryGetConfigValues(configKey, globalConfig, configFile) {
+    tryGetConfigValues(configKey, globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
+            const output = yield this.execGit([
-            if (configFile) {
+                'config',
-                args.push('--file', configFile);
+                globalConfig ? '--global' : '--local',
-            }
+                '--get-all',
-            else {
+                configKey
-                args.push(globalConfig ? '--global' : '--local');
+            ], true);
-            }
-            args.push('--get-all', configKey);
-            const output = yield this.execGit(args, true);
             if (output.exitCode !== 0) {
                 return [];
             }
             return output.stdout.trim().split('\n').filter(value => value.trim());
         });
     }
-    tryGetConfigKeys(pattern, globalConfig, configFile) {
+    tryGetConfigKeys(pattern, globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
+            const output = yield this.execGit([
-            if (configFile) {
+                'config',
-                args.push('--file', configFile);
+                globalConfig ? '--global' : '--local',
-            }
+                '--name-only',
-            else {
+                '--get-regexp',
-                args.push(globalConfig ? '--global' : '--local');
+                pattern
-            }
+            ], true);
-            args.push('--name-only', '--get-regexp', pattern);
-            const output = yield this.execGit(args, true);
             if (output.exitCode !== 0) {
                 return [];
             }

src/git-auth-helper.ts

@@ -44,6 +44,7 @@ class GitAuthHelper {
   private sshKnownHostsPath = ''
   private temporaryHomePath = ''
   private credentialsConfigPath = '' // Path to separate credentials config file in RUNNER_TEMP
+  private credentialsIncludeKeys: string[] = [] // Track includeIf config keys for cleanup
 
   constructor(
     gitCommandManager: IGitCommandManager,
@@ -82,6 +83,22 @@ class GitAuthHelper {
     await this.configureToken()
   }
 
+  private async getCredentialsConfigPath(): Promise<string> {
+    if (this.credentialsConfigPath) {
+      return this.credentialsConfigPath
+    }
+
+    const runnerTemp = process.env['RUNNER_TEMP'] || ''
+    assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
+
+    // Create a unique filename for this checkout instance
+    const configFileName = `git-credentials-${uuid()}.config`
+    this.credentialsConfigPath = path.join(runnerTemp, configFileName)
+
+    core.debug(`Credentials config path: ${this.credentialsConfigPath}`)
+    return this.credentialsConfigPath
+  }
+
   async configureTempGlobalConfig(): Promise<string> {
     // Already setup global config
     if (this.temporaryHomePath?.length > 0) {
@@ -175,10 +192,16 @@ class GitAuthHelper {
       )
 
       // Get submodule config file paths.
-      const configPaths = await this.git.getSubmoduleConfigPaths(
+      // Use `--show-origin` to get the config file path for each submodule.
+      const output = await this.git.submoduleForeach(
+        `git config --local --show-origin --name-only --get-regexp remote.origin.url`,
         this.settings.nestedSubmodules
       )
 
+      // Extract config file paths from the output (lines starting with "file:").
+      const configPaths =
+        output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || []
+
       // For each submodule, configure includeIf entries pointing to the shared credentials file.
       // Configure both host and container paths to support Docker container actions.
       for (const configPath of configPaths) {
@@ -245,10 +268,6 @@ class GitAuthHelper {
     }
   }
 
-  /**
-   * Configures SSH authentication by writing the SSH key and known hosts,
-   * and setting up the GIT_SSH_COMMAND environment variable.
-   */
   private async configureSsh(): Promise<void> {
     if (!this.settings.sshKey) {
       return
@@ -320,11 +339,6 @@ class GitAuthHelper {
     }
   }
 
-  /**
-   * Configures token-based authentication by creating a credentials config file
-   * and setting up includeIf entries to reference it.
-   * @param globalConfig Whether to configure global config instead of local
-   */
   private async configureToken(globalConfig?: boolean): Promise<void> {
     // Get the credentials config file path in RUNNER_TEMP
     const credentialsConfigPath = await this.getCredentialsConfigPath()
@@ -342,20 +356,7 @@ class GitAuthHelper {
     )
 
     // Replace the placeholder in the credentials config file
-    let content = (await fs.promises.readFile(credentialsConfigPath)).toString()
+    await this.replaceTokenPlaceholder(credentialsConfigPath)
-    const placeholderIndex = content.indexOf(this.tokenPlaceholderConfigValue)
-    if (
-      placeholderIndex < 0 ||
-      placeholderIndex != content.lastIndexOf(this.tokenPlaceholderConfigValue)
-    ) {
-      throw new Error(`Unable to replace auth placeholder in ${credentialsConfigPath}`)
-    }
-    assert.ok(this.tokenConfigValue, 'tokenConfigValue is not defined')
-    content = content.replace(
-      this.tokenPlaceholderConfigValue,
-      this.tokenConfigValue
-    )
-    await fs.promises.writeFile(credentialsConfigPath, content)
 
     // Add include or includeIf to reference the credentials config
     if (globalConfig) {
@@ -369,6 +370,7 @@ class GitAuthHelper {
       // Configure host includeIf
       const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`
       await this.git.config(hostIncludeKey, credentialsConfigPath)
+      this.credentialsIncludeKeys.push(hostIncludeKey)
 
       // Container git directory
       const githubWorkspace = process.env['GITHUB_WORKSPACE']
@@ -391,39 +393,33 @@ class GitAuthHelper {
       // Configure container includeIf
       const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
       await this.git.config(containerIncludeKey, containerCredentialsPath)
+      this.credentialsIncludeKeys.push(containerIncludeKey)
     }
   }
 
-  /**
+  private async replaceTokenPlaceholder(configPath: string): Promise<void> {
-   * Gets or creates the path to the credentials config file in RUNNER_TEMP.
+    assert.ok(configPath, 'configPath is not defined')
-   * @returns The absolute path to the credentials config file
+    let content = (await fs.promises.readFile(configPath)).toString()
-   */
+    const placeholderIndex = content.indexOf(this.tokenPlaceholderConfigValue)
-  private async getCredentialsConfigPath(): Promise<string> {
+    if (
-    if (this.credentialsConfigPath) {
+      placeholderIndex < 0 ||
-      return this.credentialsConfigPath
+      placeholderIndex != content.lastIndexOf(this.tokenPlaceholderConfigValue)
+    ) {
+      throw new Error(`Unable to replace auth placeholder in ${configPath}`)
     }
-
+    assert.ok(this.tokenConfigValue, 'tokenConfigValue is not defined')
-    const runnerTemp = process.env['RUNNER_TEMP'] || ''
+    content = content.replace(
-    assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
+      this.tokenPlaceholderConfigValue,
-
+      this.tokenConfigValue
-    // Create a unique filename for this checkout instance
+    )
-    const configFileName = `git-credentials-${uuid()}.config`
+    await fs.promises.writeFile(configPath, content)
-    this.credentialsConfigPath = path.join(runnerTemp, configFileName)
-
-    core.debug(`Credentials config path: ${this.credentialsConfigPath}`)
-    return this.credentialsConfigPath
   }
 
-  /**
-   * Removes SSH authentication configuration by cleaning up SSH keys,
-   * known hosts files, and SSH command configurations.
-   */
   private async removeSsh(): Promise<void> {
     // SSH key
     const keyPath = this.sshKeyPath || stateHelper.SshKeyPath
     if (keyPath) {
       try {
-        core.info(`Removing SSH key '${keyPath}'`)
         await io.rmRF(keyPath)
       } catch (err) {
         core.debug(`${(err as any)?.message ?? err}`)
@@ -436,70 +432,65 @@ class GitAuthHelper {
       this.sshKnownHostsPath || stateHelper.SshKnownHostsPath
     if (knownHostsPath) {
       try {
-        core.info(`Removing SSH known hosts '${knownHostsPath}'`)
         await io.rmRF(knownHostsPath)
-      } catch (err) {
+      } catch {
-        core.debug(`${(err as any)?.message ?? err}`)
+        // Intentionally empty
-        core.warning(`Failed to remove SSH known hosts '${knownHostsPath}'`)
       }
     }
 
     // SSH command
-    core.info("Removing SSH command configuration")
     await this.removeGitConfig(SSH_COMMAND_KEY)
     await this.removeSubmoduleGitConfig(SSH_COMMAND_KEY)
   }
 
-  /**
-   * Removes token-based authentication by cleaning up HTTP headers,
-   * includeIf entries, and credentials config files.
-   */
   private async removeToken(): Promise<void> {
     // Remove HTTP extra header
-    core.info("Removing HTTP extra header")
     await this.removeGitConfig(this.tokenConfigKey)
     await this.removeSubmoduleGitConfig(this.tokenConfigKey)
 
-    // Collect credentials config paths that need to be removed
-    const credentialsPaths = new Set<string>()
-
     // Remove includeIf entries that point to git-credentials-*.config files
-    core.info("Removing includeIf entries pointing to credentials config files")
+    // This is more aggressive than tracking keys, but necessary since cleanup
-    const mainCredentialsPaths = await this.removeIncludeIfCredentials()
+    // runs in a post-step where this.credentialsIncludeKeys is empty
-    mainCredentialsPaths.forEach(path => credentialsPaths.add(path))
+    try {
-
+      // Get all includeIf.gitdir keys
-    // Remove submodule includeIf entries that point to git-credentials-*.config files
+      const keys = await this.git.tryGetConfigKeys('^includeIf\\.gitdir:')
-    const submoduleConfigPaths = await this.git.getSubmoduleConfigPaths(true)
+      
-    for (const configPath of submoduleConfigPaths) {
+      for (const key of keys) {
-      const submoduleCredentialsPaths = await this.removeIncludeIfCredentials(configPath)
+        // Get all values for this key
-      submoduleCredentialsPaths.forEach(path => credentialsPaths.add(path))
+        const values = await this.git.tryGetConfigValues(key)
+        if (values.length > 0) {
+          // Remove only values that match git-credentials-<uuid>.config pattern
+          for (const value of values) {
+            if (/git-credentials-[0-9a-f-]+\.config$/i.test(value)) {
+              await this.git.tryConfigUnsetValue(key, value)
+            }
+          }
+        }
+      }
+    } catch (err) {
+      // Ignore errors - this is cleanup code
+      core.debug(`Error during includeIf cleanup: ${err}`)
     }
 
-    // Remove credentials config files
+    // Remove submodule includeIf
-    for (const credentialsPath of credentialsPaths) {
+    await this.git.submoduleForeach(
-      // Only remove credentials config files if they are under RUNNER_TEMP
+      `sh -c "git config --local --get-regexp '^includeIf\\.' && git config --local --remove-section includeIf || :"`,
-      const runnerTemp = process.env['RUNNER_TEMP']
+      true
-      assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
+    )
-      if (credentialsPath.startsWith(runnerTemp)) {
+
-        try {
+    // Remove credentials config file
-          core.info(`Removing credentials config '${credentialsPath}'`)
+    if (this.credentialsConfigPath) {
-          await io.rmRF(credentialsPath)
+      try {
-        } catch (err) {
+        await io.rmRF(this.credentialsConfigPath)
-          core.debug(`${(err as any)?.message ?? err}`)
+      } catch (err) {
-          core.warning(
+        core.debug(`${(err as any)?.message ?? err}`)
-            `Failed to remove credentials config '${credentialsPath}'`
+        core.warning(
-          )
+          `Failed to remove credentials config '${this.credentialsConfigPath}'`
-        }
+        )
-      } else {
-        core.debug(`Skipping removal of credentials config '${credentialsPath}' - not under RUNNER_TEMP`)
       }
     }
   }
 
-  /**
-   * Removes a git config key from the local repository config.
-   * @param configKey The git config key to remove
-   */
   private async removeGitConfig(configKey: string): Promise<void> {
     if (
       (await this.git.configExists(configKey)) &&
@@ -510,10 +501,6 @@ class GitAuthHelper {
     }
   }
 
-  /**
-   * Removes a git config key from all submodule configs.
-   * @param configKey The git config key to remove
-   */
   private async removeSubmoduleGitConfig(configKey: string): Promise<void> {
     const pattern = regexpHelper.escape(configKey)
     await this.git.submoduleForeach(
@@ -522,50 +509,4 @@ class GitAuthHelper {
       true
     )
   }
-
-  /**
-   * Removes includeIf entries that point to git-credentials-*.config files.
-   * @param configPath Optional path to a specific git config file to operate on
-   * @returns Array of unique credentials config file paths that were found and removed
-   */
-  private async removeIncludeIfCredentials(configPath?: string): Promise<string[]> {
-    const credentialsPaths = new Set<string>()
-    
-    try {
-      // Get all includeIf.gitdir keys
-      const keys = await this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, configPath)
-      
-      for (const key of keys) {
-        // Get all values for this key
-        const values = await this.git.tryGetConfigValues(key, false, configPath)
-        if (values.length > 0) {
-          // Remove only values that match git-credentials-<uuid>.config pattern
-          for (const value of values) {
-            if (this.testCredentialsConfigPath(value)) {
-              credentialsPaths.add(value)
-              await this.git.tryConfigUnsetValue(key, value, false, configPath)
-            }
-          }
-        }
-      }
-    } catch (err) {
-      // Ignore errors - this is cleanup code
-      if (configPath) {
-        core.debug(`Error during includeIf cleanup for ${configPath}: ${err}`)
-      } else {
-        core.debug(`Error during includeIf cleanup: ${err}`)
-      }
-    }
-    
-    return Array.from(credentialsPaths)
-  }
-
-  /**
-   * Tests if a path matches the git-credentials-*.config pattern.
-   * @param path The path to test
-   * @returns True if the path matches the credentials config pattern
-   */
-  private testCredentialsConfigPath(path: string): boolean {
-    return /git-credentials-[0-9a-f-]+\.config$/i.test(path)
-  }
 }

src/git-command-manager.ts

@@ -42,7 +42,6 @@ export interface IGitCommandManager {
     }
   ): Promise<void>
   getDefaultBranch(repositoryUrl: string): Promise<string>
-  getSubmoduleConfigPaths(recursive: boolean): Promise<string[]>
   getWorkingDirectory(): string
   init(): Promise<void>
   isDetached(): Promise<boolean>
@@ -61,11 +60,11 @@ export interface IGitCommandManager {
   tagExists(pattern: string): Promise<boolean>
   tryClean(): Promise<boolean>
   tryConfigUnset(configKey: string, globalConfig?: boolean): Promise<boolean>
-  tryConfigUnsetValue(configKey: string, configValue: string, globalConfig?: boolean, configFile?: string): Promise<boolean>
+  tryConfigUnsetValue(configKey: string, configValue: string, globalConfig?: boolean): Promise<boolean>
   tryDisableAutomaticGarbageCollection(): Promise<boolean>
   tryGetFetchUrl(): Promise<string>
-  tryGetConfigValues(configKey: string, globalConfig?: boolean, configFile?: string): Promise<string[]>
+  tryGetConfigValues(configKey: string, globalConfig?: boolean): Promise<string[]>
-  tryGetConfigKeys(pattern: string, globalConfig?: boolean, configFile?: string): Promise<string[]>
+  tryGetConfigKeys(pattern: string, globalConfig?: boolean): Promise<string[]>
   tryReset(): Promise<boolean>
   version(): Promise<GitVersion>
 }
@@ -334,21 +333,6 @@ class GitCommandManager {
     throw new Error('Unexpected output when retrieving default branch')
   }
 
-  async getSubmoduleConfigPaths(recursive: boolean): Promise<string[]> {
-    // Get submodule config file paths.
-    // Use `--show-origin` to get the config file path for each submodule.
-    const output = await this.submoduleForeach(
-      `git config --local --show-origin --name-only --get-regexp remote.origin.url`,
-      recursive
-    )
-
-    // Extract config file paths from the output (lines starting with "file:").
-    const configPaths =
-      output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || []
-
-    return configPaths
-  }
-
   getWorkingDirectory(): string {
     return this.workingDirectory
   }
@@ -484,18 +468,18 @@ class GitCommandManager {
   async tryConfigUnsetValue(
     configKey: string,
     configValue: string,
-    globalConfig?: boolean,
+    globalConfig?: boolean
-    configFile?: string
   ): Promise<boolean> {
-    const args = ['config']
+    const output = await this.execGit(
-    if (configFile) {
+      [
-      args.push('--file', configFile)
+        'config',
-    } else {
+        globalConfig ? '--global' : '--local',
-      args.push(globalConfig ? '--global' : '--local')
+        '--unset',
-    }
+        configKey,
-    args.push('--unset', configKey, configValue)
+        configValue
-    
+      ],
-    const output = await this.execGit(args, true)
+      true
+    )
     return output.exitCode === 0
   }
 
@@ -527,18 +511,17 @@ class GitCommandManager {
 
   async tryGetConfigValues(
     configKey: string,
-    globalConfig?: boolean,
+    globalConfig?: boolean
-    configFile?: string
   ): Promise<string[]> {
-    const args = ['config']
+    const output = await this.execGit(
-    if (configFile) {
+      [
-      args.push('--file', configFile)
+        'config',
-    } else {
+        globalConfig ? '--global' : '--local',
-      args.push(globalConfig ? '--global' : '--local')
+        '--get-all',
-    }
+        configKey
-    args.push('--get-all', configKey)
+      ],
-    
+      true
-    const output = await this.execGit(args, true)
+    )
 
     if (output.exitCode !== 0) {
       return []
@@ -549,18 +532,18 @@ class GitCommandManager {
 
   async tryGetConfigKeys(
     pattern: string,
-    globalConfig?: boolean,
+    globalConfig?: boolean
-    configFile?: string
   ): Promise<string[]> {
-    const args = ['config']
+    const output = await this.execGit(
-    if (configFile) {
+      [
-      args.push('--file', configFile)
+        'config',
-    } else {
+        globalConfig ? '--global' : '--local',
-      args.push(globalConfig ? '--global' : '--local')
+        '--name-only',
-    }
+        '--get-regexp',
-    args.push('--name-only', '--get-regexp', pattern)
+        pattern
-    
+      ],
-    const output = await this.execGit(args, true)
+      true
+    )
 
     if (output.exitCode !== 0) {
       return []