Keep git credentials in safe_outputs job checkouts by dsyme · Pull Request #40161 · github/gh-aw

dsyme · 2026-06-18T21:46:50Z

Keep git credentials in safe_outputs job checkouts

Summary

The safe_outputs job's checkout steps previously cleared credentials after checkout (persist-credentials: false). This broke create_pull_request and push_to_pull_request_branch handlers that need a push-capable token on disk at execution time. This change wires a keepCredentialsForPush flag through the checkout pipeline so that the safe_outputs job retains credentials.

Changes

`pkg/workflow/checkout_manager.go`

Added keepCredentialsForPush bool field to CheckoutManager.
Added SetKeepCredentialsForPush(bool) setter to expose the flag to callers.

`pkg/workflow/checkout_step_generator.go`

GenerateDefaultCheckoutStep and generateCheckoutStepLines now inspect the keepCredentialsForPush flag.
When the flag is true: emits persist-credentials: true and skips the post-checkout credential-cleanup step.
When the flag is false (default): existing behaviour is unchanged.

`pkg/workflow/compiler_safe_outputs_steps.go`

Calls checkoutManager.SetKeepCredentialsForPush(true) when building checkout steps for the safe_outputs job, so the job's git token survives to the handler execution phase.

`pkg/workflow/compiler_safe_outputs_steps_test.go`

TestBuildSharedPRCheckoutSteps updated to assert persist-credentials: true in the generated YAML.
Added checkNotContains assertion to confirm the credential-cleanup persist-credentials: false line is no longer present.

Risk assessment

Area	Impact	Breaking
`CheckoutManager` API	High — new field + setter; existing callers unaffected (default `false`)	No
Checkout step generation	High — conditional credential retention changes generated YAML	No
safe_outputs job compilation	High — safe_outputs checkout YAML now carries live credentials	No
Test coverage	Medium — existing test updated; new assertion added	No

All other job types (non-safe_outputs) continue to strip credentials by default. No breaking changes.

Generated by PR Description Updater for issue #40161 · 43.5 AIC · ⌖ 7.47 AIC · ⊞ 4.5K · ◷

The safe_outputs job reuses the agent job's checkout generators, which emit persist-credentials: false so actions/checkout strips the credential http.extraheader in its post-checkout "Removing auth" step. That default is correct for the untrusted agent job, but the safe_outputs job legitimately runs git fetch/push (create_pull_request, push_to_pull_request_branch), so stripping auth leaves it relying on a fragile re-auth dance and can break bundle/branch fetches. Add a keepCredentialsForPush mode to CheckoutManager that the safe_outputs path enables. In that mode the default and additional checkout generators emit persist-credentials: true and skip the credential-cleanup step, leaving the push-capable token on disk for the handlers. The agent job is unchanged. Fixes #40159

github-actions · 2026-06-18T21:50:38Z

Comment Memory

CI lights the path
Green checks bloom at dawn
Quiet bots still sing

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Generated by 🧪 Smoke CI for issue #40161 · ◷

Copilot

Pull request overview

Updates gh-aw’s safe_outputs checkout generation so git credentials are retained after actions/checkout, enabling reliable git fetch / git push from safe_outputs handlers (e.g., create_pull_request, push_to_pull_request_branch) while keeping the agent job’s credential-stripping behavior unchanged.

Changes:

Add a CheckoutManager mode (keepCredentialsForPush) to emit persist-credentials: true and suppress the post-checkout credential cleanup step.
Enable that mode for the safe_outputs PR checkout path (buildSharedPRCheckoutSteps) and update the associated unit test expectations.
Recompile workflows so safe_outputs checkouts in generated .lock.yml files reflect persist-credentials: true.

Show a summary per file

File	Description
pkg/workflow/compiler_safe_outputs_steps.go	Enables checkout manager “keep credentials” mode for safe_outputs PR operations.
pkg/workflow/compiler_safe_outputs_steps_test.go	Updates assertions to expect `persist-credentials: true` in safe_outputs checkout steps.
pkg/workflow/checkout_step_generator.go	Threads “keep credentials” mode into default/additional checkout YAML generation and suppresses cleanup step.
pkg/workflow/checkout_manager.go	Adds `keepCredentialsForPush` flag + setter on `CheckoutManager`.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/weekly-editors-health-check.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/weekly-blog-post-writer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/update-astro.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/unbloat-docs.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/ubuntu-image-analyzer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/tidy.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/test-create-pr-error-handling.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/technical-doc-writer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/spec-extractor.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/spec-enforcer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Recompiled lock: safe_outputs checkouts persist credentials; cross-repo git credential config env updated.
.github/workflows/smoke-project.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/smoke-multi-pr.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Recompiled lock: safe_outputs checkouts persist credentials; cross-repo git credential config env updated.
.github/workflows/slide-deck-maintainer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/schema-feature-coverage.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/ruflo-backed-task.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/refiner.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/q.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/pr-sous-chef.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/necromancer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/mergefest.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/linter-miner.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/layout-spec-maintainer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/jsweep.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/instructions-janitor.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/hourly-ci-cleaner.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/go-logger.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/glossary-maintainer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/github-mcp-tools-report.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/functional-pragmatist.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/dictation-prompt.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/developer-docs-consolidator.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/design-decision-gate.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/dependabot-worker.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/dependabot-repair.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/dead-code-remover.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-workflow-updater.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-safe-output-integrator.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-doc-updater.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-doc-healer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-community-attribution.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-caveman-optimizer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-architecture-diagram.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/craft.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/code-simplifier.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/code-scanning-fixer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/cloclo.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/ci-coach.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/changeset.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.
.github/workflows/avenger.lock.yml	Recompiled lock: safe_outputs checkout now persists credentials.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 62/62 changed files
Comments generated: 2

+	// checked-out repositories (create_pull_request, push_to_pull_request_branch), so its
+	// checkouts must retain credentials (persist-credentials: true) instead of stripping
+	// them. This keeps the push-capable token on disk for the handlers; the trusted
+	// safe_outputs handler code (not the untrusted agent) is the only consumer.
+	checkoutMgr.SetKeepCredentialsForPush(true)


 	cleanCreds := override != nil && override.cleanCreds
-	if cleanCreds {
+	if cm.keepCredentialsForPush {
+		// safe_outputs job: retain credentials so later git fetch/push can authenticate
+		// using the push-capable token installed at checkout time.
+		sb.WriteString("          persist-credentials: true\n")


The previous commit (#40161) left a doc comment in buildSafeOutputsJobs unformatted, which fails CI's fmt-check (make lint). Reformat the comment block to satisfy gofmt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings June 18, 2026 21:46

Copilot started reviewing on behalf of dsyme June 18, 2026 21:47 View session

github-actions Bot mentioned this pull request Jun 18, 2026

[aw] Smoke CI produced no safe outputs #40082

Closed

Copilot AI reviewed Jun 18, 2026

View reviewed changes

dsyme merged commit 05ac29e into main Jun 18, 2026
61 of 63 checks passed

dsyme deleted the dsyme/safe-outputs-persist-credentials branch June 18, 2026 21:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keep git credentials in safe_outputs job checkouts#40161

Keep git credentials in safe_outputs job checkouts#40161
dsyme merged 1 commit into
mainfrom
dsyme/safe-outputs-persist-credentials

dsyme commented Jun 18, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dsyme commented Jun 18, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!