feat: add setup git credentials action

.github/workflows/publish-action.yml

@@ -0,0 +1,27 @@
+name: publish-action
+on:
+  release:
+    types: released
+concurrency: ${{ github.workflow }}
+jobs:
+  publish-action:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - run: rm -rf node_modules
+      - uses: actions4git/setup-git@v1
+      - run: git add -Af && git commit -m 'npm run build'
+      - run: git tag -f "$TAG" && git push -f origin "$TAG"
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+      - uses: actions/publish-action@v0.4.0
+        with:
+          source-tag: ${{ github.event.release.tag_name }}

.github/workflows/test-action.yml

@@ -0,0 +1,55 @@
+name: Test action
+on:
+  push:
+    branches: "main"
+    paths-ignore:
+      - .gitignore
+      - README.md
+      - LICENSE
+      - .github/**
+      - "!.github/workflows/test-action.yml"
+  pull_request:
+    paths-ignore:
+      - .gitignore
+      - README.md
+      - LICENSE
+      - .github/**
+      - "!.github/workflows/test-action.yml"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  test-action:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build
+      - name: Poison git auth config
+        run: |
+          git config --local credential.helper store
+          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic stale"
+          git config --local url.https://x-access-token:stale@github.com/.insteadOf https://github.com/
+      - name: Configure raw git credentials
+        uses: ./
+        with:
+          token: ${{ github.token }}
+      - run: test -n "$GIT_ASKPASS"
+      - run: test -x "$GIT_ASKPASS"
+      - run: test "$GIT_TERMINAL_PROMPT" = "0"
+      - run: test -n "$GIT_CONFIG_GLOBAL"
+      - run: test -f "$GIT_CONFIG_GLOBAL"
+      - run: test "$GIT_CONFIG_NOSYSTEM" = "1"
+      - run: test -n "$SETUP_GIT_CREDENTIALS_TOKEN"
+      - run: test "$("$GIT_ASKPASS" Username)" = "x-access-token"
+      - run: test "$("$GIT_ASKPASS" Password)" = "$SETUP_GIT_CREDENTIALS_TOKEN"
+      - run: test -z "$(git config --local --get-all credential.helper || true)"
+      - run: test -z "$(git config --local --get-all http.https://github.com/.extraheader || true)"
+      - run: test -z "$(git config --local --get-regexp '^url\..*\.insteadOf$' || true)"
+      - run: grep -q "helper =" "$GIT_CONFIG_GLOBAL"
+      - run: git ls-remote --get-url origin | grep -q '^https://github.com/'

.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+*.log
+.DS_Store

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 kostua16
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,73 @@
+# Setup Git Credentials
+
+Configure later raw `git` commands in a GitHub Actions job to use an explicit
+token through job-scoped runtime credentials.
+
+This action is intended for workflows where `gh` may already be authenticated
+correctly, but raw `git push` can still be hijacked by stale runner Git config,
+checkout extraheaders, credential helpers, or tokenized URL rewrites.
+
+## Usage
+
+Before raw `git push`:
+
+```yml
+- uses: kostua16/setup-git-credentials@v1
+  with:
+    token: ${{ secrets.GH_PAT }}
+- run: git push origin HEAD
+```
+
+After switching `gh` to a PAT:
+
+```yml
+- uses: kostua16/setup-gh@v1
+  with:
+    token: ${{ secrets.GH_PAT }}
+    cli-token: ${{ secrets.GH_PAT }}
+    switch-account: true
+- uses: kostua16/setup-git-credentials@v1
+  with:
+    token: ${{ secrets.GH_PAT }}
+```
+
+Switch raw Git auth more than once in the same job:
+
+```yml
+- uses: kostua16/setup-git-credentials@v1
+  with:
+    token: ${{ secrets.FIRST_PAT }}
+- run: git push origin HEAD:first-branch
+
+- uses: kostua16/setup-git-credentials@v1
+  with:
+    token: ${{ secrets.SECOND_PAT }}
+- run: git push origin HEAD:second-branch
+```
+
+## Inputs
+
+- **`token`:** Required token for later raw `git` commands. No default is
+  provided so callers choose the exact credential source.
+- **`github-server-url`:** GitHub server URL to configure. Defaults to
+  `${{ github.server_url }}`.
+
+## Behavior
+
+- Exports `GIT_ASKPASS`, `GIT_TERMINAL_PROMPT=0`, `GIT_CONFIG_GLOBAL`, and
+  `GIT_CONFIG_NOSYSTEM=1` for later job steps.
+- Stores the token only in a masked job environment variable used by askpass.
+- Uses `x-access-token` as the Git username.
+- Creates temp askpass and Git config files under `RUNNER_TEMP`.
+- Clears stale checkout-local GitHub `credential.helper`,
+  `http.*.extraheader`, and `url.*.insteadOf` entries for the configured host.
+- Adds non-tokenized SSH-to-HTTPS rewrites for the configured host.
+- Never writes tokenized URLs or mutates user/global/system Git config.
+
+## Development
+
+```sh
+npm ci
+npm run typecheck
+npm run build
+```

action.yml

@@ -0,0 +1,22 @@
+name: Setup Git Credentials
+description: Configure raw git credentials for later GitHub Actions job steps
+
+branding:
+  icon: git-branch
+  color: blue
+
+inputs:
+  token:
+    description: >
+      Token to use for later raw git commands in this job. Pass the exact PAT
+      or GitHub token that should authenticate git.
+    required: true
+  github-server-url:
+    description: >
+      The GitHub server URL whose git credentials should be configured.
+      Defaults to the current github.server_url.
+    default: ${{ github.server_url }}
+
+runs:
+  using: node24
+  main: dist/main.js