From f144c88c7c6f186d87f9a21a6007bdda732eafc8 Mon Sep 17 00:00:00 2001
From: Djeex <djeex@djeex.fr>
Date: Sat, 22 Aug 2026 15:39:28 +0200
Subject: [PATCH] Prevent actions/checkout's ephemeral credential from
 overriding the bot push token

---
 .gitea/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 15eadbe..8faeb8d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,6 +16,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Build Docker image
         run: |
@@ -95,6 +96,12 @@ jobs:
             git add VERSION
             git commit -m "Bump build version to $NEW_VERSION [skip ci]"
 
+            # Belt and suspenders: actions/checkout can leave its own ephemeral
+            # credential injected as an extraheader, which would silently override
+            # the URL-embedded token below. persist-credentials:false on checkout
+            # should already prevent this, but strip it here too just in case.
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+
             git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main
           fi