feat(auth): sync git credentials with switched account

[kostua16]

Summary

feat(auth): sync raw git credentials with the switched GitHub account

• Add the opt-in update-git-credentials input, defaulting to false.
• When enabled with a token, export job-scoped Git auth through GIT_ASKPASS, GIT_TERMINAL_PROMPT=0, a masked token env var, GIT_CONFIG_GLOBAL, and GIT_CONFIG_NOSYSTEM=1.
• Clear stale checkout-local GitHub auth config for later raw git commands without writing tokenized URLs to persistent Git config.
• Document the switch-account: true + update-git-credentials: true PAT usage and extend action smoke coverage.

Feature Notes

Pros:

• Keeps raw git push aligned with the account selected by setup-gh.
• Avoids persistent tokenized Git config and self-hosted runner credential leakage.
• Neutralizes stale credential helpers, checkout extraheaders, system config, and tokenized GitHub rewrites for the job.

Cons:

• The opt-in path mutates checkout-local Git auth entries matching GitHub so later steps cannot keep using stale checkout credentials by accident.
• Runtime auth depends on Git asking for HTTPS credentials via askpass.

Impact

Build time:

• No meaningful runtime build-time impact; local bundle size changes only from the added setup logic.

Support activities:

• Should reduce self-hosted runner auth drift where gh uses the intended PAT but raw git still uses an old GitHub App/default token.
• Debug mode now reports sanitized auth-config origins and temp auth paths without printing tokens or decoded auth headers.

Validation

• npx tsc --noEmit
• npm run build
• actionlint .github/workflows/test-action.yml .github/workflows/publish-action.yml
• git diff --check
• Local built-action smoke test for update-git-credentials: true
• Local built-action smoke test for default update-git-credentials: false

[kilo-code-bot]

WARNING: The auth-config pattern only matches the bare credential.helper key and omits URL-scoped credential helpers (e.g. credential.https://github.com.helper / credential.<host>.helper).

On self-hosted runners — the stated use case for update-git-credentials — stale GitHub-scoped credential helpers may be configured under a URL subsection. Such entries are neither surfaced by debugGitAuthConfigOrigins (which reuses this same pattern) nor removed by scrubLocalGitAuthConfig, because shouldUnsetLocalGitAuthConfig only special-cases the bare credential.helper. The empty helper = reset written to GIT_CONFIG_GLOBAL does not backstop this either: it is read before local config, so later-accumulated local URL-scoped helpers are never cleared. A stale credential.<host>.helper entry can therefore keep feeding an outdated token to raw git, bypassing the askpass credentials this feature installs.

Extending the pattern to match credential(?:\\..*)?\\.helper and adding a corresponding server-scoped branch in shouldUnsetLocalGitAuthConfig would close the gap.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
src/main.ts	19	Auth-config pattern only matches bare credential.helper, leaving stale URL-scoped credential.<host>.helper helpers neither surfaced nor scrubbed — a credential-leak path on the self-hosted use case this feature targets.

Files Reviewed (4 files)

• .github/workflows/test-action.yml - 0 issues
• README.md - 0 issues
• action.yml - 0 issues
• src/main.ts - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by glm-5.2-short · Input: 46.1K · Output: 14.3K · Cached: 364.9K}

[kostua16]

Superseded by the standalone setup-git-credentials action: https://github.com/kostua16/setup-git-credentials. Closing this setup-gh PR so raw Git credential switching has a single owner.