Add `checkout.clean-git-credentials` to support submodule-safe checkout credential cleanup by Copilot · Pull Request #32819 · github/gh-aw

Copilot · 2026-05-17T13:34:20Z

Compiled workflows were forcing persist-credentials: false on generated actions/checkout steps, which breaks on repositories with submodules during checkout post-step cleanup. This change adds an explicit frontmatter mode to keep credentials persisted for checkout while still cleaning git credentials in a submodule-compatible way.

Problem scope
- Generated checkout steps in agent workflows used persist-credentials: false unconditionally.
- In submodule-heavy/sparse scenarios, checkout post-cleanup can fail with missing submodule URL/path errors.
Compiler/frontmatter changes
- Added checkout.clean-git-credentials: bool to checkout config parsing/modeling.
- Wired the flag through checkout resolution/merge logic so it can be applied per checkout target.
Checkout generation behavior
- When clean-git-credentials: true:
  - emit persist-credentials: true on that checkout step
  - inject Clean git credentials after checkout immediately after the checkout
- Cleanup step behavior:
  - prefers shared clean_git_credentials.sh from setup assets when available
  - falls back to inline cleanup logic (credential + http.*.extraheader removal)
  - scans both repo and submodule git configs (.git/config and .git/modules/*/config)
Credential cleaner hardening
- Updated shared actions/setup/sh/clean_git_credentials.sh to include submodule config paths and deeper nested module traversal.

checkout:
  repository: owner/repo
  clean-git-credentials: true

- uses: actions/checkout@...
  with:
    persist-credentials: true
- name: Clean git credentials after checkout
  continue-on-error: true
  run: |
    # uses shared cleaner when available, else inline fallback

pr-sous-chef: branch update requested by run https://github.com/github/gh-aw/actions/runs/25995204443

Generated by 👨‍🍳 PR Sous Chef · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-17T13:50:43Z

+          # The shared cleaner script is available only after Setup Scripts has copied
+          # actions into ${RUNNER_TEMP}/gh-aw/actions. This checkout-time step may run
+          # earlier, so keep an inline fallback for pre-setup execution.
+          if [ -x "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh" ]; then
+            echo "Using shared clean_git_credentials.sh from setup action"
+            bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+            exit 0
+          fi
+          echo "Shared clean_git_credentials.sh not available yet; using inline fallback"
+          cleaned=0
+          while IFS= read -r git_config; do
+            git config --file "${git_config}" --remove-section credential 2>/dev/null || true
+            git config --file "${git_config}" --unset-all http.extraheader 2>/dev/null || true
+            git config --file "${git_config}" --get-regexp '^http\..*\.extraheader$' 2>/dev/null | while read -r key _; do
+              git config --file "${git_config}" --unset-all "${key}" || true
+            done || true
+            cleaned=$((cleaned + 1))
+          done < <(find "${GITHUB_WORKSPACE}" /tmp -maxdepth 15 -type f -name "config" \( -path "*/.git/config" -o -path "*/.git/modules/*/config" \) 2>/dev/null | sort -u)
+          if [ "${cleaned}" -eq 0 ]; then
+            echo "No git config files found for cleanup"
+          fi


@copilot move to helper file in actions/setup/sh

Done in 65317ac. I moved the checkout-time fallback cleanup logic out of checkout_step_generator.go into actions/setup/sh/clean_git_credentials_pre_setup.sh and updated the generated checkout cleanup step to use helper script paths.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-17T14:12:53Z

@copilot find an agentic workflow in the repo with a checkout field (not checkout: false) and enable this flag.

github-actions · 2026-05-17T15:45:13Z

@copilot review all comments and address the unresolved review feedback before the next pass.

Generated by 👨‍🍳 PR Sous Chef · ◷

pelikhan · 2026-05-17T16:14:04Z

@copilot rename clean-git-credentials to force-clean-git-credentials

…credentials Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-17T16:26:52Z

@copilot rename clean-git-credentials to force-clean-git-credentials

Done in 2855e3d. I renamed the checkout frontmatter key to force-clean-git-credentials across parser handling, schema, tests, and updated .github/workflows/smoke-claude.md plus its recompiled lock file.

github-actions · 2026-05-17T16:41:49Z

Please review the changes and address any remaining feedback.
``
@copilot review all comments

Generated by 👨‍🍳 PR Sous Chef · ◷

pelikhan · 2026-05-17T17:01:30Z

 	return steps
 }

+func generateCheckoutCredentialsCleanupStep() string {


@copilot is this dead code?

No — it’s an intentional fallback path, not dead code. The primary path is ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials_checkout.sh, and this inline branch is only for cases where that helper is missing at runtime (for example setup assets not present).

pelikhan · 2026-05-17T17:10:32Z

@copilot remove the fallback, the script file is guaranteed to exist

github-actions · 2026-05-17T17:14:00Z

@copilot review all comments

Please remove the fallback the maintainer called out, then rerun checks and share the result.

Generated by 👨‍🍳 PR Sous Chef · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-17T17:19:32Z

@copilot remove the fallback, the script file is guaranteed to exist

Implemented in ba7b0fb. I removed the generated checkout cleanup fallback and now call only bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials_checkout.sh".

github-actions · 2026-05-17T19:16:38Z

@copilot review all comments and address any unresolved review feedback.
Then post a short blocker summary if anything still needs maintainer input.

Generated by 👨‍🍳 PR Sous Chef · ◷

github-actions · 2026-05-17T20:37:17Z

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

Potential security threats were detected in the agent output.

Review the workflow run logs for details.

@copilot merge main and recompile, then rerun the checks.
Please clear the remaining lint and gate failures so this is ready for maintainer review.

Generated by 👨‍🍳 PR Sous Chef · ◷

pelikhan · 2026-05-17T20:43:04Z

@copilot review the changes in tbe clean git credentials shell script

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-17T20:51:13Z

@copilot review the changes in tbe clean git credentials shell script

Reviewed and tightened coverage in b10b7cf. I added shell tests for .git/modules/**/config cleanup (including nested module configs), URL-scoped extraheader removal, and authenticated submodule remote URL sanitization.

Initial plan

f1653e3

Copilot AI assigned Copilot and pelikhan May 17, 2026

Copilot started work on behalf of pelikhan May 17, 2026 13:34 View session

Copilot AI linked an issue May 17, 2026 that may be closed by this pull request

Compiled lock files use persist-credentials: false on checkout steps — fails on repos with submodules #31658

Closed

Copilot AI and others added 2 commits May 17, 2026 13:44

Add checkout clean-git-credentials option

c5ddca1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Polish checkout cleanup comments

9dd7b20

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix compiled lock files to handle submodules correctly~~ Add checkout.clean-git-credentials to support submodule-safe checkout credential cleanup May 17, 2026

Copilot finished work on behalf of pelikhan May 17, 2026 13:48

Copilot AI requested a review from pelikhan May 17, 2026 13:48

pelikhan reviewed May 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 17, 2026 13:50 View session

Copilot AI and others added 13 commits May 17, 2026 13:58

Move checkout cleanup fallback into setup helper script

d170926

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Use lowercase mutable counter in pre-setup cleaner script

e711428

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refine pre-setup cleanup messaging and variable names

d0955cf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Tighten cleanup step assertions and helper naming

379245a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Rename pre-setup counter to processed configs

4b0b33e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Broaden helper lookup paths for checkout cleanup

dc1ef4e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify helper logs and assert fallback ordering

f662aad

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Align cleanup warning and fallback path coverage

48d6b13

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Improve cleanup warning specificity and test assertions

8db7a47

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Shorten cleanup warning and relax message assertions

5095c42

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add helper script header and structured warning text

a17f389

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify skipped-cleanup warning and tighten order check

bc2601b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Shorten cleanup warning and clarify helper comment

65317ac

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 17, 2026 14:10

Copilot AI requested a review from pelikhan May 17, 2026 14:10

Copilot started work on behalf of pelikhan May 17, 2026 14:13 View session

pelikhan marked this pull request as ready for review May 17, 2026 14:18

Copilot started work on behalf of pelikhan May 17, 2026 16:14 View session

refactor: rename checkout credential cleanup flag to force-clean-git-…

2855e3d

…credentials Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 17, 2026 16:27

Merge branch 'main' into copilot/fix-compiled-lock-files

56e7f45

pelikhan reviewed May 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 17, 2026 17:01 View session

Copilot finished work on behalf of pelikhan May 17, 2026 17:07

Copilot AI requested a review from pelikhan May 17, 2026 17:07

Copilot started work on behalf of pelikhan May 17, 2026 17:10 View session

github-actions Bot mentioned this pull request May 17, 2026

[Contribution Check Report] Contribution Check — 2026-05-17 #32727

Open

Remove checkout cleanup inline fallback

ba7b0fb

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 17, 2026 17:20

Copilot started work on behalf of pelikhan May 17, 2026 20:43 View session

Copilot AI and others added 3 commits May 17, 2026 20:46

Plan clean credential script review

53d2b09

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Revert accidental smoke lock update

f72eef9

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add submodule coverage to git credential cleaner test

b10b7cf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 17, 2026 20:51

pelikhan merged commit 95dca68 into main May 17, 2026

pelikhan deleted the copilot/fix-compiled-lock-files branch May 17, 2026 20:52

Conversation

Copilot AI commented May 17, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan May 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 17, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

pelikhan commented May 17, 2026

Uh oh!

Copilot AI commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

pelikhan May 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 17, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Copilot AI commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

pelikhan commented May 17, 2026

Uh oh!

Copilot AI commented May 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 17, 2026 •

edited by github-actions Bot

Loading