Merge eddff1118c into ff7abcd0c3

.github/workflows/test.yml

@@ -299,7 +299,7 @@ jobs:
   test-output:
     runs-on: ubuntu-latest
     steps:
-      # Download the action at the current ref
+      # Clone this repo
       - name: Checkout
         uses: actions/checkout@v4.1.6
         with:

__test__/verify-submodules-recursive.sh

@@ -17,7 +17,7 @@ fi
 
 echo "Testing persisted credential"
 pushd ./submodules-recursive/submodule-level-1/submodule-level-2
-git config --local --name-only --get-regexp http.+extraheader && git fetch
+git config --local --includes --name-only --get-regexp http.+extraheader && git fetch
 if [ "$?" != "0" ]; then
     echo "Failed to validate persisted credential"
     popd

__test__/verify-submodules-true.sh

@@ -17,7 +17,7 @@ fi
 
 echo "Testing persisted credential"
 pushd ./submodules-true/submodule-level-1
-git config --local --name-only --get-regexp http.+extraheader && git fetch
+git config --local --includes --name-only --get-regexp http.+extraheader && git fetch
 if [ "$?" != "0" ]; then
     echo "Failed to validate persisted credential"
     popd

dist/index.js

@@ -238,7 +238,9 @@ class GitAuthHelper {
                 yield this.git.tryConfigUnset(this.insteadOfKey, true);
                 if (!this.settings.sshKey) {
                     for (const insteadOfValue of this.insteadOfValues) {
-                        yield this.git.config(this.insteadOfKey, insteadOfValue, true, true);
+                        yield this.git.config(this.insteadOfKey, insteadOfValue, true, // globalConfig?
+                        true // add?
+                        );
                     }
                 }
             }
@@ -255,17 +257,10 @@ class GitAuthHelper {
             // Remove possible previous HTTPS instead of SSH
             yield this.removeSubmoduleGitConfig(this.insteadOfKey);
             if (this.settings.persistCredentials) {
-                // Credentials config path
-                const credentialsConfigPath = yield this.getCredentialsConfigPath();
+                // Get the credentials config file path in RUNNER_TEMP
+                const credentialsConfigPath = this.getCredentialsConfigPath();
                 // Container credentials config path
                 const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
-                // Container repo path
-                const workingDirectory = this.git.getWorkingDirectory();
-                const githubWorkspace = process.env['GITHUB_WORKSPACE'];
-                assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
-                let relativePath = path.relative(githubWorkspace, workingDirectory);
-                relativePath = relativePath.replace(/\\/g, '/');
-                const containerRepoPath = path.posix.join('/github/workspace', relativePath);
                 // Get submodule config file paths.
                 const configPaths = yield this.git.getSubmoduleConfigPaths(this.settings.nestedSubmodules);
                 // For each submodule, configure includeIf entries pointing to the shared credentials file.
@@ -275,12 +270,19 @@ class GitAuthHelper {
                     let submoduleGitDir = path.dirname(configPath); // The config file is at .git/modules/submodule-name/config
                     submoduleGitDir = submoduleGitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                     // Configure host includeIf
-                    yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, false, configPath);
-                    // Configure container includeIf
+                    yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, // globalConfig?
+                    false, // add?
+                    configPath);
+                    // Container submodule git directory
+                    const githubWorkspace = process.env['GITHUB_WORKSPACE'];
+                    assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
                     let relativeSubmoduleGitDir = path.relative(githubWorkspace, submoduleGitDir);
                     relativeSubmoduleGitDir = relativeSubmoduleGitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                     const containerSubmoduleGitDir = path.posix.join('/github/workspace', relativeSubmoduleGitDir);
-                    yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, false, configPath);
+                    // Configure container includeIf
+                    yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, // globalConfig?
+                    false, // add?
+                    configPath);
                 }
                 if (this.settings.sshKey) {
                     // Configure core.sshCommand
@@ -379,12 +381,14 @@ class GitAuthHelper {
     configureToken(globalConfig) {
         return __awaiter(this, void 0, void 0, function* () {
             // Get the credentials config file path in RUNNER_TEMP
-            const credentialsConfigPath = yield this.getCredentialsConfigPath();
+            const credentialsConfigPath = this.getCredentialsConfigPath();
             // Write placeholder to the separate credentials config file using git config.
             // This approach avoids the credential being captured by process creation audit events,
             // which are commonly logged. For more information, refer to
             // https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
-            yield this.git.config(this.tokenConfigKey, this.tokenPlaceholderConfigValue, false, false, credentialsConfigPath);
+            yield this.git.config(this.tokenConfigKey, this.tokenPlaceholderConfigValue, false, // globalConfig?
+            false, // add?
+            credentialsConfigPath);
             // Replace the placeholder in the credentials config file
             let content = (yield fs.promises.readFile(credentialsConfigPath)).toString();
             const placeholderIndex = content.indexOf(this.tokenPlaceholderConfigValue);
@@ -398,7 +402,8 @@ class GitAuthHelper {
             // Add include or includeIf to reference the credentials config
             if (globalConfig) {
                 // Global config file is temporary
-                yield this.git.config('include.path', credentialsConfigPath, true);
+                yield this.git.config('include.path', credentialsConfigPath, true // globalConfig?
+                );
             }
             else {
                 // Host git directory
@@ -408,9 +413,9 @@ class GitAuthHelper {
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
                 yield this.git.config(hostIncludeKey, credentialsConfigPath);
                 // Container git directory
+                const workingDirectory = this.git.getWorkingDirectory();
                 const githubWorkspace = process.env['GITHUB_WORKSPACE'];
                 assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
-                const workingDirectory = this.git.getWorkingDirectory();
                 let relativePath = path.relative(githubWorkspace, workingDirectory);
                 relativePath = relativePath.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                 const containerGitDir = path.posix.join('/github/workspace', relativePath, '.git');
@@ -427,18 +432,16 @@ class GitAuthHelper {
      * @returns The absolute path to the credentials config file
      */
     getCredentialsConfigPath() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.credentialsConfigPath) {
-                return this.credentialsConfigPath;
-            }
-            const runnerTemp = process.env['RUNNER_TEMP'] || '';
-            assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
-            // Create a unique filename for this checkout instance
-            const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
-            this.credentialsConfigPath = path.join(runnerTemp, configFileName);
-            core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
+        if (this.credentialsConfigPath) {
             return this.credentialsConfigPath;
-        });
+        }
+        const runnerTemp = process.env['RUNNER_TEMP'] || '';
+        assert.ok(runnerTemp, 'RUNNER_TEMP is not defined');
+        // Create a unique filename for this checkout instance
+        const configFileName = `git-credentials-${(0, uuid_1.v4)()}.config`;
+        this.credentialsConfigPath = path.join(runnerTemp, configFileName);
+        core.debug(`Credentials config path: ${this.credentialsConfigPath}`);
+        return this.credentialsConfigPath;
     }
     /**
      * Removes SSH authentication configuration by cleaning up SSH keys,
@@ -556,10 +559,12 @@ class GitAuthHelper {
             const credentialsPaths = new Set();
             try {
                 // Get all includeIf.gitdir keys
-                const keys = yield this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, configPath);
+                const keys = yield this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, // globalConfig?
+                configPath);
                 for (const key of keys) {
                     // Get all values for this key
-                    const values = yield this.git.tryGetConfigValues(key, false, configPath);
+                    const values = yield this.git.tryGetConfigValues(key, false, // globalConfig?
+                    configPath);
                     if (values.length > 0) {
                         // Remove only values that match git-credentials-<uuid>.config pattern
                         for (const value of values) {

src/git-auth-helper.ts

@@ -136,7 +136,12 @@ class GitAuthHelper {
       await this.git.tryConfigUnset(this.insteadOfKey, true)
       if (!this.settings.sshKey) {
         for (const insteadOfValue of this.insteadOfValues) {
-          await this.git.config(this.insteadOfKey, insteadOfValue, true, true)
+          await this.git.config(
+            this.insteadOfKey,
+            insteadOfValue,
+            true, // globalConfig?
+            true // add?
+          )
         }
       }
     } catch (err) {
@@ -154,8 +159,8 @@ class GitAuthHelper {
     await this.removeSubmoduleGitConfig(this.insteadOfKey)
 
     if (this.settings.persistCredentials) {
-      // Credentials config path
-      const credentialsConfigPath = await this.getCredentialsConfigPath()
+      // Get the credentials config file path in RUNNER_TEMP
+      const credentialsConfigPath = this.getCredentialsConfigPath()
 
       // Container credentials config path
       const containerCredentialsPath = path.posix.join(
@@ -163,17 +168,6 @@ class GitAuthHelper {
         path.basename(credentialsConfigPath)
       )
 
-      // Container repo path
-      const workingDirectory = this.git.getWorkingDirectory()
-      const githubWorkspace = process.env['GITHUB_WORKSPACE']
-      assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
-      let relativePath = path.relative(githubWorkspace, workingDirectory)
-      relativePath = relativePath.replace(/\\/g, '/')
-      const containerRepoPath = path.posix.join(
-        '/github/workspace',
-        relativePath
-      )
-
       // Get submodule config file paths.
       const configPaths = await this.git.getSubmoduleConfigPaths(
         this.settings.nestedSubmodules
@@ -190,12 +184,14 @@ class GitAuthHelper {
         await this.git.config(
           `includeIf.gitdir:${submoduleGitDir}.path`,
           credentialsConfigPath,
-          false,
-          false,
+          false, // globalConfig?
+          false, // add?
           configPath
         )
 
-        // Configure container includeIf
+        // Container submodule git directory
+        const githubWorkspace = process.env['GITHUB_WORKSPACE']
+        assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
         let relativeSubmoduleGitDir = path.relative(
           githubWorkspace,
           submoduleGitDir
@@ -205,11 +201,13 @@ class GitAuthHelper {
           '/github/workspace',
           relativeSubmoduleGitDir
         )
+
+        // Configure container includeIf
         await this.git.config(
           `includeIf.gitdir:${containerSubmoduleGitDir}.path`,
           containerCredentialsPath,
-          false,
-          false,
+          false, // globalConfig?
+          false, // add?
           configPath
         )
       }
@@ -327,7 +325,7 @@ class GitAuthHelper {
    */
   private async configureToken(globalConfig?: boolean): Promise<void> {
     // Get the credentials config file path in RUNNER_TEMP
-    const credentialsConfigPath = await this.getCredentialsConfigPath()
+    const credentialsConfigPath = this.getCredentialsConfigPath()
 
     // Write placeholder to the separate credentials config file using git config.
     // This approach avoids the credential being captured by process creation audit events,
@@ -336,8 +334,8 @@ class GitAuthHelper {
     await this.git.config(
       this.tokenConfigKey,
       this.tokenPlaceholderConfigValue,
-      false,
-      false,
+      false, // globalConfig?
+      false, // add?
       credentialsConfigPath
     )
 
@@ -362,7 +360,11 @@ class GitAuthHelper {
     // Add include or includeIf to reference the credentials config
     if (globalConfig) {
       // Global config file is temporary
-      await this.git.config('include.path', credentialsConfigPath, true)
+      await this.git.config(
+        'include.path',
+        credentialsConfigPath,
+        true // globalConfig?
+      )
     } else {
       // Host git directory
       let gitDir = path.join(this.git.getWorkingDirectory(), '.git')
@@ -373,9 +375,9 @@ class GitAuthHelper {
       await this.git.config(hostIncludeKey, credentialsConfigPath)
 
       // Container git directory
+      const workingDirectory = this.git.getWorkingDirectory()
       const githubWorkspace = process.env['GITHUB_WORKSPACE']
       assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
-      const workingDirectory = this.git.getWorkingDirectory()
       let relativePath = path.relative(githubWorkspace, workingDirectory)
       relativePath = relativePath.replace(/\\/g, '/') // Use forward slashes, even on Windows
       const containerGitDir = path.posix.join(
@@ -400,7 +402,7 @@ class GitAuthHelper {
    * Gets or creates the path to the credentials config file in RUNNER_TEMP.
    * @returns The absolute path to the credentials config file
    */
-  private async getCredentialsConfigPath(): Promise<string> {
+  private getCredentialsConfigPath(): string {
     if (this.credentialsConfigPath) {
       return this.credentialsConfigPath
     }
@@ -542,13 +544,17 @@ class GitAuthHelper {
       // Get all includeIf.gitdir keys
       const keys = await this.git.tryGetConfigKeys(
         '^includeIf\\.gitdir:',
-        false,
+        false, // globalConfig?
         configPath
       )
 
       for (const key of keys) {
         // Get all values for this key
-        const values = await this.git.tryGetConfigValues(key, false, configPath)
+        const values = await this.git.tryGetConfigValues(
+          key,
+          false, // globalConfig?
+          configPath
+        )
         if (values.length > 0) {
           // Remove only values that match git-credentials-<uuid>.config pattern
           for (const value of values) {