feat: add auth header for gha run (#571)

When code refs run in GHA, it can't prune branches, because of the lack
in authentication.
This small code change uses the GITHUB_TOKEN in the GHA context to
interact with the remote server, enabling branch deletion for private
repos.

---------

Co-authored-by: Ramon Niebla <nieblara@msu.edu>

Author: Hegi

internal/git/git.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -13,6 +14,8 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/diff"
 	object "github.com/go-git/go-git/v5/plumbing/object"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/http"
 
 	"github.com/launchdarkly/ld-find-code-refs/v2/internal/ld"
 	"github.com/launchdarkly/ld-find-code-refs/v2/options"
@@ -199,13 +202,25 @@ func (c *Client) RemoteBranches() (branches map[string]bool, err error) {
 		return branches, err
 	}
 
+	// Configure authentication for GitHub Actions
+	var auth transport.AuthMethod
+	if os.Getenv("GITHUB_ACTIONS") == "true" {
+		if token := os.Getenv("GITHUB_TOKEN"); token != "" {
+			log.Debug.Printf("using GitHub token authentication for remote operations")
+			auth = &http.BasicAuth{
+				Username: "x-access-token", // GitHub requires this specific username
+				Password: token,
+			}
+		}
+	}
+
 	remotes, err := repo.Remotes()
 	if err != nil {
 		return branches, err
 	}
 
 	for _, r := range remotes {
-		refList, err := r.List(&git.ListOptions{})
+		refList, err := r.List(&git.ListOptions{Auth: auth})
 		if err != nil {
 			return branches, err
 		}