Prevent actions/checkout's ephemeral credential from overriding the bot push token

2026-08-22 15:39:28 +02:00
parent 1f0a664a4f
commit f144c88c7c
1 changed files with 7 additions and 0 deletions
@@ -16,6 +16,7 @@ jobs:
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: Build Docker image
        run: |
@@ -95,6 +96,12 @@ jobs:
            git add VERSION
            git commit -m "Bump build version to $NEW_VERSION [skip ci]"

+            # Belt and suspenders: actions/checkout can leave its own ephemeral
+            # credential injected as an extraheader, which would silently override
+            # the URL-embedded token below. persist-credentials:false on checkout
+            # should already prevent this, but strip it here too just in case.
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+
            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main
          fi