Summary
On a self-hosted Windows runner, actions/checkout v7.0.0 cleanup treats the temporary credentials config path as a Git value regex. Native Windows backslashes make that regex invalid, so checkout emits error: invalid pattern while removing its includeIf entries.
Environment
- Runner: self-hosted Windows x64
- Git:
2.51.2.windows.1
- Action:
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0)
persist-credentials: default (true)- Repository/worktree paths: native
C:\... paths
Reproduction
A normal checkout is sufficient:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
v7 creates local include conditions similar to:
includeIf.gitdir:C:/runner/_work/repo/repo/.git.path C:\runner\_work\_temp\git-credentials-<id>.config
includeIf.gitdir:C:/runner/_work/repo/repo/.git/worktrees/*.path C:\runner\_work\_temp\git-credentials-<id>.config
During post-job cleanup it runs the equivalent of:
git config --local --unset includeif.gitdir:C:/runner/_work/repo/repo/.git.path C:\runner\_work\_temp\git-credentials-<id>.config
and Git reports:
error: invalid pattern: C:\runner\_work\_temp\git-credentials-<id>.config
The same error can appear at the start of a later checkout while it tries to remove stale includeIf entries.
Expected behavior
Checkout should remove only the exact value it created without interpreting the Windows path as a regex. For example, cleanup could use Git's fixed-value matching where available or correctly escape the value pattern.
Post-job cleanup should leave no checkout-created includeIf entries and emit no error annotations.
Actual behavior / impact
- Cleanup emits
error: invalid pattern for native Windows credential paths.
- Checkout may continue and the workflow can still conclude successfully, making the cleanup defect easy to miss.
- A later checkout on the persistent self-hosted worktree sees the stale entries and repeats the error.
Verified workaround
Pinning actions/checkout v5.0.1 (93cb6efe18208431cddfb8368fd83d5badbf9bfd) avoids this v7 credential-layout cleanup path while still using the Node 24 runtime. On the same runner, the workflow completed with zero Node 20 warnings, zero invalid-pattern messages, and no stale checkout-created includeIf entries.
Summary
On a self-hosted Windows runner,
actions/checkoutv7.0.0 cleanup treats the temporary credentials config path as a Git value regex. Native Windows backslashes make that regex invalid, so checkout emitserror: invalid patternwhile removing itsincludeIfentries.Environment
2.51.2.windows.1actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0(v7.0.0)persist-credentials: default (true)C:\...pathsReproduction
A normal checkout is sufficient:
v7 creates local include conditions similar to:
During post-job cleanup it runs the equivalent of:
and Git reports:
The same error can appear at the start of a later checkout while it tries to remove stale
includeIfentries.Expected behavior
Checkout should remove only the exact value it created without interpreting the Windows path as a regex. For example, cleanup could use Git's fixed-value matching where available or correctly escape the value pattern.
Post-job cleanup should leave no checkout-created
includeIfentries and emit no error annotations.Actual behavior / impact
error: invalid patternfor native Windows credential paths.Verified workaround
Pinning
actions/checkoutv5.0.1 (93cb6efe18208431cddfb8368fd83d5badbf9bfd) avoids this v7 credential-layout cleanup path while still using the Node 24 runtime. On the same runner, the workflow completed with zero Node 20 warnings, zero invalid-pattern messages, and no stale checkout-createdincludeIfentries.