PR creation broken

[tcurdt]

TLDR: The PR creation fails with "Duplicate header: Authorization"

The job hasn't changed and worked fine last week.

name: flake-update-lock

on:
  workflow_dispatch: # allows manual triggering
  schedule:
    - cron: "5 4 * * 0" # runs weekly on Sunday at 04:05

permissions:
  pull-requests: write
  issues: write
  repository-projects: write
  contents: write

jobs:
  lockfile:
    runs-on: ubuntu-latest
    steps:
      - name: checkout repository
        uses: actions/checkout@v6
      - name: install nix
        uses: DeterminateSystems/nix-installer-action@main
      - name: update flake.lock
        uses: DeterminateSystems/update-flake-lock@main
        with:
          pr-title: "update flake.lock" # title of PR to be created
          pr-labels: | # labels to be set on the PR
            dependencies
            automated

Run peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e
  with:
    branch: update_flake_lock_action
    delete-branch: true
    committer: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
    author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
    title: update flake.lock
    token: ***
    labels: dependencies
  automated
  
    body: Automated changes by the [update-flake-lock](https://github.com/DeterminateSystems/update-flake-lock) GitHub Action.
  
  Flake lock file updates:
  
  • Updated input 'comin':
      'github:nlewo/comin/f0db785' (2025-11-03)
    → 'github:nlewo/comin/a07ada7' (2025-11-22)
  • Updated input 'nixpkgs-stable':
      'github:nixos/nixpkgs/3acb677' (2025-11-13)
    → 'github:nixos/nixpkgs/c58bc7f' (2025-11-20)
  • Updated input 'nixpkgs-unstable':
      'github:nixos/nixpkgs/c5ae371' (2025-11-12)
    → 'github:nixos/nixpkgs/117cc7f' (2025-11-20)
  
  ### Running GitHub Actions on this PR
  
  GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.
  
  **To run GitHub Actions workflows on this PR, close and re-open this pull request.**
    commit-message: [create-pull-request] automated change
    signoff: false
    draft: false
  env:
    DETSYS_BACKTRACE_COLLECTOR: d37cd50d-d4ff-4ea1-a7f0-88df4522bb9f
    DETERMINATE_NIX_KVM: 1
    GIT_AUTHOR_NAME: github-actions[bot]
    GIT_AUTHOR_EMAIL: <github-actions[bot]@users.noreply.github.com>
    GIT_COMMITTER_NAME: github-actions[bot]
    GIT_COMMITTER_EMAIL: <github-actions[bot]@users.noreply.github.com>
    GIT_COMMIT_MESSAGE: Flake lock file updates:
  
  • Updated input 'comin':
      'github:nlewo/comin/f0db785' (2025-11-03)
    → 'github:nlewo/comin/a07ada7' (2025-11-22)
  • Updated input 'nixpkgs-stable':
      'github:nixos/nixpkgs/3acb677' (2025-11-13)
    → 'github:nixos/nixpkgs/c58bc7f' (2025-11-20)
  • Updated input 'nixpkgs-unstable':
      'github:nixos/nixpkgs/c5ae371' (2025-11-12)
    → 'github:nixos/nixpkgs/117cc7f' (2025-11-20)
Prepare git configuration
  /usr/bin/git config --global --name-only --get-regexp safe.directory /home/runner/work/nixcfg/nixcfg
  /usr/bin/git config --global --add safe.directory /home/runner/work/nixcfg/nixcfg
  /usr/bin/git config --local --get remote.origin.url
  https://github.com/tcurdt/nixcfg
  /usr/bin/git config --local --name-only --get-regexp http.https://github.com/.extraheader ^AUTHORIZATION:
Determining the base and head repositories
Pull request branch target repository set to tcurdt/nixcfg
Configuring credential for HTTPS authentication
  /usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
  /usr/bin/git rev-parse --git-dir
  .git
Checking the base repository state
  /usr/bin/git symbolic-ref HEAD --short
  main
  Working base is branch 'main'
  /usr/bin/git remote prune origin
  remote: Duplicate header: "Authorization"
  fatal: unable to access 'https://github.com/tcurdt/nixcfg/': The requested URL returned error: 400
  Error: The process '/usr/bin/git' failed with exit code 128

[henrytill]

This appears to be a result of moving to actions/checkout@v6.

Failure with actions/checkout@v6:
https://github.com/henrytill/bits-lean/actions/runs/19618853187

Success after downgrading to actions/checkout@v5:
https://github.com/henrytill/bits-lean/actions/runs/19618939900

[tcurdt]

Hm. That's weird.

[tcurdt]

Found something peter-evans/create-pull-request#4230

[adomixaszvers]

v6 works without persisted credentials

      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

I have a successful run https://github.com/adomixaszvers/dotfiles-nix/actions/runs/19641872601

[tcurdt]

v6 works without persisted credentials

  - name: Checkout
    uses: actions/checkout@v6
    with:
      persist-credentials: false

I have a successful run https://github.com/adomixaszvers/dotfiles-nix/actions/runs/19641872601

Confirmed! ... This also works for me.

I still think the correct fix would be to upgrade peter-evans/create-pull-request but this is a great work around.

update-flake-lock/action.yml

Line 205 in e637603

uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5