configureGitAuth function incompatible with actions/checkout@v4.3.1,v5.0.1,v6

[StuporHero]

Description

The Claude GitHub App is installed on our repository with Read and write permissions for Contents, Pull Requests, and Issues (confirmed via the installation settings page). However, the installation token returned by the OIDC exchange does not have write access to repository contents, causing git push to fail with a 403.

Reproduction

1. Install the official Claude GitHub App with Read & Write for code, PRs, and issues
2. Configure workflow with claude_code_oauth_token and id-token: write
3. Trigger Claude on a PR (in our case, created by a different GitHub App bot)
4. Claude commits locally, then runs git push origin HEAD

Error

remote: Write access to repository not granted.
fatal: unable to access 'https://github.com/<org>/<repo>.git/': The requested URL returned error: 403

Diagnostics

We had Claude run diagnostic commands during a workflow run:

• OIDC exchange succeeds: Logs show App token successfully obtained
• Git remote URL is correctly rewritten: https://x-access-token:REDACTED@github.com/...
• Token lacks write permissions:

  // gh api /installation/repositories --jq '.repositories[0].permissions'
  {"admin": false, "maintain": false, "pull": false, "push": false, "triage": false}

• Push dry-run confirms the 403
• App installation page confirms: Read and write access to code, discussions, issues, pull requests, and workflows
• Claude CAN comment on issues and PRs, so the token has some write permissions — just not contents

Configuration

permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write
  actions: read

steps:
  - uses: anthropics/claude-code-action@v1
    with:
      claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      additional_permissions: |
        actions: read

The additional_permissions input means the exchange request should include {contents: "write", pull_requests: "write", issues: "write", actions: "read"} per the source in token.ts.

Workaround

Passing an explicit github_token input (from a separate GitHub App via actions/create-github-app-token) bypasses the OIDC exchange and works.

[StuporHero]

Root Cause Found

The issue is a compatibility problem between configureGitAuth and actions/checkout@v6.

What changed in checkout v6

actions/checkout@v6 (released November 2025) changed how persist-credentials works. PR #2286 moved credential storage from the local git config into a separate config file included via includeIf.gitdir:

git config --file /tmp/git-credentials-<uuid>.config http.https://github.com/.extraheader AUTHORIZATION: basic ***
git config --local includeIf.gitdir:<repo>.path /tmp/git-credentials-<uuid>.config

Why configureGitAuth doesn't clear it

configureGitAuth in src/github/operations/git-config.ts runs:

await $`git config --unset-all http.${GITHUB_SERVER_URL}/.extraheader`;

This only clears extraheaders set directly in the local git config. It does not remove the includeIf entries or the external credentials file. So the read-only GITHUB_TOKEN credential persists and takes precedence over the app token set in the remote URL.

Evidence

We ran diagnostics during a workflow run and confirmed:

• The extraheader from checkout was still present (via includeIf)
• Git was authenticating as github-actions[bot] (the GITHUB_TOKEN identity) instead of claude[bot]
• The push error identified github-actions[bot] by name: Permission to <repo> denied to github-actions[bot]

Workaround

Setting persist-credentials: false on actions/checkout@v6 prevents the extraheader from being set at all. However, the action's own git fetch for PR branches runs before configureGitAuth, so it needs some credentials to be present. This means persist-credentials: false breaks the PR branch fetch.

A working workaround is to downgrade to actions/checkout@v4.3.0 (pre-credential file change which was backported to v4.3.1 and v5.0.1), but that's not a real fix.

Suggested fix

configureGitAuth needs to also remove the includeIf.gitdir entries and/or delete the external credentials config file, matching what checkout v6's own post-step cleanup does:

git config --local --name-only --get-regexp ^includeIf\.gitdir:
git config --local --unset includeif.gitdir:<path>.path <credentials-file>
rm <credentials-file>

Note: actions/checkout@v4.3.1 and v5.0.1 also backported v6 cleanup changes, so they may be affected too.