Repository navigation
safe_outputs checkout sets persist-credentials: true and fails on git 2.55 (could not read Username) #64483
Description
Activity
- locked and limited conversation to collaborators
on Sep 30, 2026 - unlocked this conversation
on Sep 30, 2026 @copilot all git write operations should be done in other jobs
- linked a pull request that will close this issueDisable credential persistence for safe-output checkouts #64496
on Sep 30, 2026 @pelikhan, I saw your note that git writes should happen in other jobs, and that #64496 was closed without merging. For the
create_pull_requestandpush_to_pull_request_branchpaths, should the checkout move out ofsafe_outputsentirely, rather than just switch topersist-credentials: false? We’re carrying a temporary control-plane patch for the checkout failure, so I’d like to align it with the intended upstream design. What’s the preferred change?@rameshreddy-adutla i need to spend more time reviewing this one.
Reacted by Ramesh Reddy Adutla- locked and limited conversation to collaborators
on Oct 1, 2026 - unlocked this conversation
on Oct 1, 2026 Status (2026-10-07; Maintainer direction): The September 30 maintainer comment says git writes should happen in other jobs, but the maintainer said on October 1 that this issue needs more review; #64496 closed without merging. The next step is to confirm whether the safe-outputs checkout should move to another job or retain its current placement with
persist-credentials: false.
The compiled safe_outputs job emits its "Checkout repository" step with
persist-credentials: true, unlike the agent/detection checkouts which use
persist-credentials: false. On a runner with git 2.55.0, only the
persist-credentials: true checkout fails at fetch:
Every persist-credentials: false checkout in the same run succeeds on the same
runner, and the token is valid (the same token is used successfully by
github-script steps in other jobs of the run). actions/checkout is on the latest
release (v7.0.1), so this is not an out-of-date action.
The safe_outputs job already runs its own git credential configuration step
(configure_git_credentials.sh) immediately after checkout, so the push does not
rely on the checkout persisting credentials. persist-credentials: true buys
nothing here and is the trigger for the failure.
Request: emit persist-credentials: false for the safe_outputs checkout
(aligning it with the agent/detection checkouts), or make it configurable.
Environment: self-hosted Linux runner, git 2.55.0, actions/checkout@v7.0.1.