Problem

Even after setting the remote URL to use RELEASE_PAT, git push still fails with:

! [remote rejected] ... (refusing to allow a GitHub App to create or update workflow without workflows permission)

The push URL in the error shows https://github.com/YiAgent/OpenCI.git — not the RELEASE_PAT URL we set.

Root Cause

actions/checkout sets http.https://github.com/.extraheader with github.token. This extra header is sent with ALL git operations to GitHub, overriding the RELEASE_PAT in the URL.

Fix

Clear the extraheader before pushing:

git config --local --unset-all 'http.https://github.com/.extraheader' || true
git push "https://x-access-token:${RELEASE_PAT}@github.com/..." "${branch}"

no-issue

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

Greptile Summary

This PR fixes a git push failure where actions/checkout was injecting github.token via http.https://github.com/.extraheader, which overrode the RELEASE_PAT credentials in the remote URL on every request. The fix clears the extraheader before pushing and passes the PAT directly in the push URL instead of pre-configuring the remote.

• The git remote set-url approach is replaced by an explicit git config --local --unset-all 'http.https://github.com/.extraheader' || true before the push, which is the correct and commonly recommended pattern for this scenario.
• The || true appropriately handles the case where the extraheader key is absent (e.g., exit code 5 from git config), keeping the script compatible with set -euo pipefail.
• The PAT is still masked in GitHub Actions runner logs since RELEASE_PAT is declared as a secret.

Confidence Score: 5/5

Safe to merge — the change is a minimal, targeted fix to a real push failure with no logic regressions.

The fix correctly targets the root cause: actions/checkout's injected extraheader silently wins the auth negotiation over credentials embedded in the remote URL. Clearing it before the push is the established pattern for this problem. The || true guard is appropriate under set -euo pipefail. No other logic in the workflow is altered.

No files require special attention; the change is confined to four lines in the push step.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Runner as GitHub Runner
    participant GitConfig as Git Config
    participant GitHub as github.com

    Note over Runner,GitHub: actions/checkout injects github.token
    Runner->>GitConfig: Set extraheader with github.token

    Note over Runner,GitHub: OLD push behavior
    Runner->>GitConfig: set-url origin with PAT in URL
    Runner->>GitHub: git push origin branch
    GitHub-->>Runner: Rejected — extraheader overrides PAT creds

    Note over Runner,GitHub: NEW push behavior (this PR)
    Runner->>GitConfig: unset-all extraheader
    Runner->>GitHub: git push PAT-URL branch
    GitHub-->>Runner: Accepted — only PAT credentials sent

_{Reviews (1): Last reviewed commit: "fix(ci): clear extraheader before pushin..." | Re-trigger Greptile}