dist/index.js

@@ -270,12 +270,11 @@ class GitAuthHelper {
             // Remove possible previous HTTPS instead of SSH
             yield this.removeGitConfig(this.insteadOfKey, true);
             if (this.settings.persistCredentials) {
-                // TODO: UPDATE THIS
                 // Configure a placeholder value. This approach avoids the credential being captured
                 // by process creation audit events, which are commonly logged. For more information,
                 // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
                 const output = yield this.git.submoduleForeach(
-                // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
+                // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
                 `sh -c "git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url"`, this.settings.nestedSubmodules);
                 // Replace the placeholder
                 const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
@@ -381,34 +380,31 @@ class GitAuthHelper {
             yield this.replaceTokenPlaceholder(credentialsConfigPath);
             // Add include or includeIf to reference the credentials config
             if (globalConfig) {
-                // Global config file is temporary
+                // For global config, use unconditional include.
+                // No need to track for cleanup since the temp .gitconfig file (which contains
+                // this include.path entry) gets deleted by removeGlobalConfig().
                 yield this.git.config('include.path', credentialsConfigPath, true);
             }
             else {
                 // For local config, use includeIf.gitdir to match the .git directory.
                 // Configure for both host and container paths to support Docker container actions.
-                let gitDir = path.join(this.git.getWorkingDirectory(), '.git');
+                const gitDir = path.join(this.git.getWorkingDirectory(), '.git');
-                console.log(`Git dir: ${gitDir}`);
-                core.info(`Git dir: ${gitDir}`);
-                // Use forward slashes for git config, even on Windows
-                gitDir = gitDir.replace(/\\/g, '/');
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
                 yield this.git.config(hostIncludeKey, credentialsConfigPath);
                 this.credentialsIncludeKeys.push(hostIncludeKey);
                 // Configure for container scenario where paths are mapped to fixed locations
                 const githubWorkspace = process.env['GITHUB_WORKSPACE'];
-                assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
+                if (githubWorkspace) {
-                // Calculate the relative path of the working directory from GITHUB_WORKSPACE
+                    // Calculate the relative path of the working directory from GITHUB_WORKSPACE
-                const workingDirectory = this.git.getWorkingDirectory();
+                    const workingDirectory = this.git.getWorkingDirectory();
-                let relativePath = path.relative(githubWorkspace, workingDirectory);
+                    const relativePath = path.relative(githubWorkspace, workingDirectory);
-                // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
+                    // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
-                // Use forward slashes for git config
+                    const containerGitDir = path.posix.join('/github/workspace', relativePath, '.git');
-                relativePath = relativePath.replace(/\\/g, '/');
+                    const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
-                const containerGitDir = path.posix.join('/github/workspace', relativePath, '.git');
+                    const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`;
-                const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
+                    yield this.git.config(containerIncludeKey, containerCredentialsPath);
-                const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`;
+                    this.credentialsIncludeKeys.push(containerIncludeKey);
-                yield this.git.config(containerIncludeKey, containerCredentialsPath);
+                }
-                this.credentialsIncludeKeys.push(containerIncludeKey);
             }
         });
     }

src/git-auth-helper.ts

@@ -171,13 +171,11 @@ class GitAuthHelper {
     await this.removeGitConfig(this.insteadOfKey, true)
 
     if (this.settings.persistCredentials) {
-      // TODO: UPDATE THIS
-
       // Configure a placeholder value. This approach avoids the credential being captured
       // by process creation audit events, which are commonly logged. For more information,
       // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
       const output = await this.git.submoduleForeach(
-        // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
+        // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
         `sh -c "git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url"`,
         this.settings.nestedSubmodules
       )
@@ -313,44 +311,40 @@ class GitAuthHelper {
 
     // Add include or includeIf to reference the credentials config
     if (globalConfig) {
-      // Global config file is temporary
+      // For global config, use unconditional include.
+      // No need to track for cleanup since the temp .gitconfig file (which contains
+      // this include.path entry) gets deleted by removeGlobalConfig().
       await this.git.config('include.path', credentialsConfigPath, true)
     } else {
       // For local config, use includeIf.gitdir to match the .git directory.
       // Configure for both host and container paths to support Docker container actions.
-      let gitDir = path.join(this.git.getWorkingDirectory(), '.git')
+      const gitDir = path.join(this.git.getWorkingDirectory(), '.git')
-      console.log(`Git dir: ${gitDir}`)
-      core.info(`Git dir: ${gitDir}`)
-      // Use forward slashes for git config, even on Windows
-      gitDir = gitDir.replace(/\\/g, '/')
       const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`
       await this.git.config(hostIncludeKey, credentialsConfigPath)
       this.credentialsIncludeKeys.push(hostIncludeKey)
 
       // Configure for container scenario where paths are mapped to fixed locations
       const githubWorkspace = process.env['GITHUB_WORKSPACE']
-      assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
+      if (githubWorkspace) {
-      
+        // Calculate the relative path of the working directory from GITHUB_WORKSPACE
-      // Calculate the relative path of the working directory from GITHUB_WORKSPACE
+        const workingDirectory = this.git.getWorkingDirectory()
-      const workingDirectory = this.git.getWorkingDirectory()
+        const relativePath = path.relative(githubWorkspace, workingDirectory)
-      let relativePath = path.relative(githubWorkspace, workingDirectory)
 
-      // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
+        // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
-      // Use forward slashes for git config
+        const containerGitDir = path.posix.join(
-      relativePath = relativePath.replace(/\\/g, '/')
+          '/github/workspace',
-      const containerGitDir = path.posix.join(
+          relativePath,
-        '/github/workspace',
+          '.git'
-        relativePath,
+        )
-        '.git'
+        const containerCredentialsPath = path.posix.join(
-      )
+          '/github/runner_temp',
-      const containerCredentialsPath = path.posix.join(
+          path.basename(credentialsConfigPath)
-        '/github/runner_temp',
+        )
-        path.basename(credentialsConfigPath)
-      )
 
-      const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
+        const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
-      await this.git.config(containerIncludeKey, containerCredentialsPath)
+        await this.git.config(containerIncludeKey, containerCredentialsPath)
-      this.credentialsIncludeKeys.push(containerIncludeKey)
+        this.credentialsIncludeKeys.push(containerIncludeKey)
+      }
     }
   }