Fix compatibility with actions/checkout@v6

Resolves issue #4228 by temporarily hiding checkout@v6 credential files
to prevent duplicate Authorization headers.

Solution approach:
- Backup /git-credentials-*.config files before configuring auth
- Configure action's auth in .git/config as normal
- Restore credential files on cleanup

This avoids the duplicate header error while properly preserving and
restoring checkout's credentials for use in subsequent workflow steps.

Based on recommendation from:
actions/checkout#2299 (comment)

Author: ericsciple

dist/index.js

@@ -1103,6 +1103,7 @@ class GitConfigHelper {
         this.extraheaderConfigPlaceholderValue = 'AUTHORIZATION: basic ***';
         this.extraheaderConfigValueRegex = '^AUTHORIZATION:';
         this.persistedExtraheaderConfigValue = '';
+        this.backedUpCredentialFiles = [];
         this.git = git;
         this.workingDirectory = this.git.getWorkingDirectory();
     }
@@ -1182,12 +1183,16 @@ class GitConfigHelper {
         return __awaiter(this, void 0, void 0, function* () {
             const serverUrl = new url_1.URL(`https://${this.getGitRemote().hostname}`);
             this.extraheaderConfigKey = `http.${serverUrl.origin}/.extraheader`;
+            // Backup checkout@v6 credential files if they exist
+            yield this.backupCheckoutCredentials();
             // Save and unset persisted extraheader credential in git config if it exists
             this.persistedExtraheaderConfigValue = yield this.getAndUnset();
         });
     }
     restorePersistedAuth() {
         return __awaiter(this, void 0, void 0, function* () {
+            // Restore checkout@v6 credential files if they were backed up
+            yield this.restoreCheckoutCredentials();
             if (this.persistedExtraheaderConfigValue) {
                 try {
                     yield this.setExtraheaderConfig(this.persistedExtraheaderConfigValue);
@@ -1224,6 +1229,49 @@ class GitConfigHelper {
             yield this.gitConfigStringReplace(this.extraheaderConfigPlaceholderValue, extraheaderConfigValue);
         });
     }
+    backupCheckoutCredentials() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Temporarily hide checkout@v6 credential files to avoid duplicate auth headers
+            // See: https://github.com/actions/checkout/issues/2299#issuecomment-3565808237
+            const runnerTemp = process.env['RUNNER_TEMP'];
+            if (!runnerTemp) {
+                return;
+            }
+            try {
+                const files = yield fs.promises.readdir(runnerTemp);
+                for (const file of files) {
+                    if (file.startsWith('git-credentials-') && file.endsWith('.config')) {
+                        const sourcePath = path.join(runnerTemp, file);
+                        const backupPath = `${sourcePath}.bak`;
+                        yield fs.promises.rename(sourcePath, backupPath);
+                        this.backedUpCredentialFiles.push(backupPath);
+                        core.info(`Temporarily hiding checkout credential file: ${file} (will be restored after)`);
+                    }
+                }
+            }
+            catch (e) {
+                // If directory doesn't exist or we can't read it, just continue
+                core.debug(`Could not backup credential files: ${utils.getErrorMessage(e)}`);
+            }
+        });
+    }
+    restoreCheckoutCredentials() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Restore checkout@v6 credential files that were backed up
+            for (const backupPath of this.backedUpCredentialFiles) {
+                try {
+                    const originalPath = backupPath.replace(/\.bak$/, '');
+                    yield fs.promises.rename(backupPath, originalPath);
+                    const fileName = path.basename(originalPath);
+                    core.info(`Restored checkout credential file: ${fileName}`);
+                }
+                catch (e) {
+                    core.warning(`Failed to restore credential file ${backupPath}: ${utils.getErrorMessage(e)}`);
+                }
+            }
+            this.backedUpCredentialFiles = [];
+        });
+    }
     getAndUnset() {
         return __awaiter(this, void 0, void 0, function* () {
             let configValue = '';

src/git-config-helper.ts

@@ -22,6 +22,7 @@ export class GitConfigHelper {
   private extraheaderConfigPlaceholderValue = 'AUTHORIZATION: basic ***'
   private extraheaderConfigValueRegex = '^AUTHORIZATION:'
   private persistedExtraheaderConfigValue = ''
+  private backedUpCredentialFiles: string[] = []
 
   private constructor(git: GitCommandManager) {
     this.git = git
@@ -121,11 +122,15 @@ export class GitConfigHelper {
   async savePersistedAuth(): Promise<void> {
     const serverUrl = new URL(`https://${this.getGitRemote().hostname}`)
     this.extraheaderConfigKey = `http.${serverUrl.origin}/.extraheader`
+    // Backup checkout@v6 credential files if they exist
+    await this.backupCheckoutCredentials()
     // Save and unset persisted extraheader credential in git config if it exists
     this.persistedExtraheaderConfigValue = await this.getAndUnset()
   }
 
   async restorePersistedAuth(): Promise<void> {
+    // Restore checkout@v6 credential files if they were backed up
+    await this.restoreCheckoutCredentials()
     if (this.persistedExtraheaderConfigValue) {
       try {
         await this.setExtraheaderConfig(this.persistedExtraheaderConfigValue)
@@ -169,6 +174,50 @@ export class GitConfigHelper {
     )
   }
 
+  private async backupCheckoutCredentials(): Promise<void> {
+    // Temporarily hide checkout@v6 credential files to avoid duplicate auth headers
+    // See: https://github.com/actions/checkout/issues/2299#issuecomment-3565808237
+    const runnerTemp = process.env['RUNNER_TEMP']
+    if (!runnerTemp) {
+      return
+    }
+
+    try {
+      const files = await fs.promises.readdir(runnerTemp)
+      for (const file of files) {
+        if (file.startsWith('git-credentials-') && file.endsWith('.config')) {
+          const sourcePath = path.join(runnerTemp, file)
+          const backupPath = `${sourcePath}.bak`
+          await fs.promises.rename(sourcePath, backupPath)
+          this.backedUpCredentialFiles.push(backupPath)
+          core.info(
+            `Temporarily hiding checkout credential file: ${file} (will be restored after)`
+          )
+        }
+      }
+    } catch (e) {
+      // If directory doesn't exist or we can't read it, just continue
+      core.debug(`Could not backup credential files: ${utils.getErrorMessage(e)}`)
+    }
+  }
+
+  private async restoreCheckoutCredentials(): Promise<void> {
+    // Restore checkout@v6 credential files that were backed up
+    for (const backupPath of this.backedUpCredentialFiles) {
+      try {
+        const originalPath = backupPath.replace(/\.bak$/, '')
+        await fs.promises.rename(backupPath, originalPath)
+        const fileName = path.basename(originalPath)
+        core.info(`Restored checkout credential file: ${fileName}`)
+      } catch (e) {
+        core.warning(
+          `Failed to restore credential file ${backupPath}: ${utils.getErrorMessage(e)}`
+        )
+      }
+    }
+    this.backedUpCredentialFiles = []
+  }
+
   private async getAndUnset(): Promise<string> {
     let configValue = ''
     // Save and unset persisted extraheader credential in git config if it exists