Repository navigation
safe_outputs checkout sets persist-credentials: true and fails on git 2.55 (could not read Username) #64483
Description
The compiled safe_outputs job emits its "Checkout repository" step with
persist-credentials: true, unlike the agent/detection checkouts which use
persist-credentials: false. On a runner with git 2.55.0, only the
persist-credentials: true checkout fails at fetch:
fatal: could not read Username for 'https://github.com': terminal prompts disabled
(exit code 128)
Every persist-credentials: false checkout in the same run succeeds on the same
runner, and the token is valid (the same token is used successfully by
github-script steps in other jobs of the run). actions/checkout is on the latest
release (v7.0.1), so this is not an out-of-date action.
The safe_outputs job already runs its own git credential configuration step
(configure_git_credentials.sh) immediately after checkout, so the push does not
rely on the checkout persisting credentials. persist-credentials: true buys
nothing here and is the trigger for the failure.
Request: emit persist-credentials: false for the safe_outputs checkout
(aligning it with the agent/detection checkouts), or make it configurable.
Environment: self-hosted Linux runner, git 2.55.0, actions/checkout@v7.0.1.
Activity
pelikhan commentedon Sep 30, 2026
@copilot all git write operations should be done in other jobs
rameshreddy-adutla commentedon Oct 1, 2026
@pelikhan, I saw your note that git writes should happen in other jobs, and that #64496 was closed without merging. For the
create_pull_requestandpush_to_pull_request_branchpaths, should the checkout move out ofsafe_outputsentirely, rather than just switch topersist-credentials: false? We’re carrying a temporary control-plane patch for the checkout failure, so I’d like to align it with the intended upstream design. What’s the preferred change?pelikhan commentedon Oct 1, 2026
@rameshreddy-adutla i need to spend more time reviewing this one.
pelikhan commentedon Oct 7, 2026
Status (2026-10-07; Maintainer direction): The September 30 maintainer comment says git writes should happen in other jobs, but the maintainer said on October 1 that this issue needs more review; #64496 closed without merging. The next step is to confirm whether the safe-outputs checkout should move to another job or retain its current placement with
persist-credentials: false.pelikhan commentedon Oct 16, 2026
Current-state refresher (2026-10-16): Still relevant; the requested checkout change has not landed.
Current main's shared PR checkout setup explicitly calls
SetKeepCredentialsForPush(true)for the trustedsafe_outputsjob. The checkout renderer and regressions still distinguish PR-writing safe-output checkouts from credential-free agent checkouts. Consequently, the claim that all generated checkouts now usepersist-credentials: falsewould be incorrect for this path.#64496 (disable persistence) and #64887 (opt-in dynamic checkout) were both closed without merging. The maintainer's direction to reconsider where git writes belong has therefore not yet resulted in either proposed remedy on main.
Remaining gap: choose and implement the credential/write-job architecture, then verify the reported Git 2.55 / self-hosted checkout-fetch failure with that design. Static code/test inspection only; I did not reproduce the runner-specific authentication failure or claim that switching the flag alone is now safe.
pelikhan commentedon Oct 22, 2026
Rechecked 2026-10-22 against current
main(ffdd9c9): still relevant; neither proposed remedy has merged.The trusted PR-writing
safe_outputsjob still callsSetKeepCredentialsForPush(true)and supplies the push credential. Regression expectations explicitly require persistence for create-PR and push-to-PR-branch. Credential-free agent checkout guidance therefore does not establish that this apply-job path was fixed. #64496 and #64887 remain closed without merging.checkout.multiis not the proposedsafe-outputs.dynamic-checkoutworkaround: its current contract also retains credentials in the PR safe-output job.Next step: settle the trusted write-job/authentication design raised above, then validate credential-free initial checkout plus explicitly authenticated later fetch/push, or the chosen replacement architecture, on the reported self-hosted Git 2.55 / checkout v7.0.1 environment. Cover both PR-writing outputs and per-checkout private-repository credentials; do not assume removing persistence alone preserves all consumers. Static inspection confirms the emitted setting, not the runner-specific failure; no live reproduction was performed.