`persist-credentials` in separate file breaks GitHub authentication for Git worktrees

[zhangyoufu]

Description

Since #2286 and v6.0.0 release, Git credential management was updated to persist credentials in a separate configuration file. This file is currently loaded using Git's includeIf mechanism to improve security by isolating sensitive credentials from the main .git/config.

While this works for both main repository and submodule, it causes authentication failures in CI/CD workflows that utilize Git worktrees.

Current Behavior

checkout/src/git-auth-helper.ts

Lines 373 to 375 in c2d88d3

	// Configure host includeIf
	const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`
	await this.git.config(hostIncludeKey, credentialsConfigPath)

checkout/src/git-auth-helper.ts

Lines 395 to 397 in c2d88d3

	// Configure container includeIf
	const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
	await this.git.config(containerIncludeKey, containerCredentialsPath)

The current configuration uses an includeIf directive that strictly matches the main Git directory:

[includeIf "gitdir:/home/runner/work/owner/repo/.git"]
    path = /path/to/credentials/file

When a new worktree is created, the gitdir resolves to a subdirectory pattern (typically .git/worktrees/name). Because the current directive does not match this path, the credential helper config is not included, and Git operations inside the worktree fail to authenticate.

Proposed Solution

To support worktrees, we need to add a second includeIf directive that matches the worktrees subdirectory pattern.

Suggested Configuration:

# Existing match for the main repo
[includeIf "gitdir:/home/runner/work/owner/repo/.git"]
    path = /path/to/credentials/file

# PROPOSED ADDITION: Match for worktrees
[includeIf "gitdir:/home/runner/work/owner/repo/.git/worktrees/*"]
    path = /path/to/credentials/file

[evanrich]

I wonder if this is why my gitea ci/cd pipeline fails on one testing stage when validating this update.

[command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +323ae36760810bb0cb644912a4794565784484bb:refs/remotes/origin/renovate/actions-checkout-6.x
fatal: could not read Username for 'https://git.server.tld': terminal prompts disabled
The process '/usr/bin/git' failed with exit code 128
Waiting 15 seconds before trying again
[command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +323ae36760810bb0cb644912a4794565784484bb:refs/remotes/origin/renovate/actions-checkout-6.x
fatal: could not read Username for 'https://git.server.tld': terminal prompts disabled
The process '/usr/bin/git' failed with exit code 128
Waiting 13 seconds before trying again
[command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +323ae36760810bb0cb644912a4794565784484bb:refs/remotes/origin/renovate/actions-checkout-6.x
fatal: could not read Username for 'https://git.server.tld': terminal prompts disabled
::remove-matcher owner=checkout-git::
::error::The process '/usr/bin/git' failed with exit code 128
  ❌  Failure - Main Clone repository
exit status 1

[ericsciple]

@zhangyoufu can you help me understand more about your scenario? I'm also wondering whether a second checkout step would workaround the problem, instead of worktrees? I'm trying to get a better understanding of the scenario.

[ericsciple]

Proposed fix:

• Add worktree support for persist-credentials includeIf #2327

[ericsciple]

@zhangyoufu the fix is merged to main. Do you want to try it out and confirm it works for your scenario? I can create a proper release tomorrow.

[zhangyoufu]

@zhangyoufu can you help me understand more about your scenario?

I create new worktree that push togh-pages branch during CI/CD. It is expected to share the automatic authentication. I am aware that there're actions/deploy-pages and APIs for deploying GitHub Pages. This is what I used to do.

I also create worktree that targeting a somehow isolated state branch, to read/write persistent data that I don't want to mix with the code in main branch.

[zhangyoufu]

Do you want to try it out and confirm it works for your scenario?

Tested actions/checkout@033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1. It works.

[ericsciple]

Thanks @zhangyoufu for confirmation! I will do the release today

[ericsciple]

This is fixed with v6.0.1 and the v6 tag is updated now too

https://github.com/actions/checkout/tags