Repository navigation
Refresh - gh pr checkout 4500 - "build(deps-dev): bump js-yaml from 4.2.0 to 5.4.2" - #4500
Closed
reideromaum wants to merge 16 commits into
Closed
reideromaum wants to merge 16 commits into
reideromaum wants to merge 16 commits into
Conversation
Replace the workaround that hid/restored checkout@v6 credential files with a proper implementation that aligns with actions/checkout@v6's new authentication approach. Changes: - Store credentials in separate config file in RUNNER_TEMP with UUID - Use git's includeIf.gitdir mechanism to conditionally include credentials - Support both host and Docker container paths for credential resolution - Add worktree path support for git worktrees - Maintain backwards compatibility with checkout@v4/v5 old-style auth GitCommandManager: - Add configFile parameter to config() method - Add tryConfigUnsetValue() for key-value specific unset - Add tryGetConfigValues() for multi-value config keys - Add tryGetConfigKeys() for regex pattern matching config keys GitConfigHelper: - Remove hacky hide/unhide credential file approach - Add getCredentialsConfigPath() for UUID-based credential file paths - Add configureIncludeIf() for setting up includeIf entries - Add removeIncludeIfCredentials() for cleanup - Retain setExtraheaderConfig() for restoring old-style persisted auth
The credentialIncludes array was missing a type annotation, causing TypeScript to infer it as never[] and reject string pushes.
The tryConfigUnsetValue method was passing file paths directly to `git config --unset`, which treats the value argument as an extended regular expression. File paths contain `.` characters that would match any character instead of literal periods, potentially causing incorrect matches. Adding the --fixed-value flag ensures the value is treated as a literal string, fixing credential config cleanup in the v6-style authentication.
Previously, removeIncludeIfCredentials() deleted all includeIf.gitdir entries matching git-credentials-*.config, regardless of which action created them. This broke subsequent workflow steps that relied on credentials persisted by other actions (e.g., actions/checkout@v6). Now the cleanup only removes the specific credentials file and config entries created by this action instance, leaving other actions' credentials intact.
Use path.resolve() to normalize paths before comparison in removeIncludeIfCredentials(). The previous startsWith() check was vulnerable to path traversal attacks where a path like "/tmp/runner/../../../etc/passwd" would pass the check but resolve outside RUNNER_TEMP. Also append path.sep to prevent false positives (e.g., /tmp/runner2 matching /tmp/runner).
Agente MOSSAD UM
Update cpr-command.yml
Atualização do "Revert 1 patch 1"
This reverts commit 6260a74.
This reverts commit 11e8dc7.
reideromaum
changed the title
reideromaum
marked this pull request as draft
October 23, 2026 16:25
reideromaum
marked this pull request as ready for review
October 23, 2026 16:25
Revert "Support credential files"
…ial-files Revert 6 revert 5 support credential files
* feat: adopt checkout@v6 auth pattern using credentials files Replace the workaround that hid/restored checkout@v6 credential files with a proper implementation that aligns with actions/checkout@v6's new authentication approach. Changes: - Store credentials in separate config file in RUNNER_TEMP with UUID - Use git's includeIf.gitdir mechanism to conditionally include credentials - Support both host and Docker container paths for credential resolution - Add worktree path support for git worktrees - Maintain backwards compatibility with checkout@v4/v5 old-style auth GitCommandManager: - Add configFile parameter to config() method - Add tryConfigUnsetValue() for key-value specific unset - Add tryGetConfigValues() for multi-value config keys - Add tryGetConfigKeys() for regex pattern matching config keys GitConfigHelper: - Remove hacky hide/unhide credential file approach - Add getCredentialsConfigPath() for UUID-based credential file paths - Add configureIncludeIf() for setting up includeIf entries - Add removeIncludeIfCredentials() for cleanup - Retain setExtraheaderConfig() for restoring old-style persisted auth * fix: add type annotation to fix TS2345 error in integration test The credentialIncludes array was missing a type annotation, causing TypeScript to infer it as never[] and reject string pushes. * fix: use --fixed-value flag when unsetting git config values The tryConfigUnsetValue method was passing file paths directly to `git config --unset`, which treats the value argument as an extended regular expression. File paths contain `.` characters that would match any character instead of literal periods, potentially causing incorrect matches. Adding the --fixed-value flag ensures the value is treated as a literal string, fixing credential config cleanup in the v6-style authentication. * fix: only remove credentials created by this action instance Previously, removeIncludeIfCredentials() deleted all includeIf.gitdir entries matching git-credentials-*.config, regardless of which action created them. This broke subsequent workflow steps that relied on credentials persisted by other actions (e.g., actions/checkout@v6). Now the cleanup only removes the specific credentials file and config entries created by this action instance, leaving other actions' credentials intact. * fix(security): prevent path traversal in credentials file deletion Use path.resolve() to normalize paths before comparison in removeIncludeIfCredentials(). The previous startsWith() check was vulnerable to path traversal attacks where a path like "/tmp/runner/../../../etc/passwd" would pass the check but resolve outside RUNNER_TEMP. Also append path.sep to prevent false positives (e.g., /tmp/runner2 matching /tmp/runner). * Update cpr-command.yml Agente MOSSAD UM * Merge pull request #2 from leoroma1/revert-1-patch-1 Atualização do "Revert 1 patch 1" * Revert "Merge pull request #2 from leoroma1/revert-1-patch-1" This reverts commit 6260a74. * Revert "Support credential files" --------- Co-authored-by: Peter Evans <18365890+peter-evans@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refresh
Agente TZAHAL e FOIA 16520
#4468