Description

When using plugin_marketplaces with a private or internal GitHub repository, marketplace cloning fails with:

✘ Failed to add marketplace: Failed to clone marketplace repository: HTTPS authentication failed. Ensure your token has access to this repository.
Original error: Cloning into '/home/runner/.claude/plugins/marketplaces/temp_1769074856991'...
remote: Repository not found.
fatal: repository 'https://github.com/org/private-marketplace.git/' not found

This occurs even when:

• GITHUB_TOKEN is properly set in the environment
• The GitHub App is installed on the marketplace repository
• The token has verified access to the repository

Steps to Reproduce

1. Create a private/internal marketplace repository (e.g., org/private-marketplace)
2. Install the Claude GitHub App on both repositories (main repo + marketplace)
3. Configure workflow with:

   - uses: anthropics/claude-code-action@v1
     with:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
       plugin_marketplaces: "https://github.com/org/private-marketplace.git"

4. Trigger the workflow via @claude comment
5. Observe marketplace clone failure

Expected Behavior

The action should successfully clone private marketplace repositories using the GITHUB_TOKEN obtained via OIDC or provided via github_token input.

Actual Behavior

Git fails to authenticate during git clone, reporting "repository not found" (GitHub's standard error for permission denied).

Root Cause

Investigation of the codebase reveals:

1. Git authentication IS configured in src/github/operations/git-config.ts (configureGitAuth())
2. BUT this function is only called in agent/tag modes
3. Marketplace installation happens in base-action/src/index.ts → installPlugins() → spawns claude plugin marketplace add <url>
4. Git has no credential helper configured at this point → authentication fails

Relevant code locations:

• base-action/src/install-plugins.ts:191-201 - marketplace cloning
• src/github/operations/git-config.ts:22-61 - git auth function (unused in base-action)
• base-action/src/index.ts:10-24 - entry point (missing git config call)

Proposed Solution

Call configureGitAuth() (or equivalent) in base-action/src/index.ts before installPlugins():

import { configureGitAuth } from '../src/github/operations/git-config';

// In base-action/src/index.ts
const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
if (token) {
  await configureGitAuth(token); // Configure git before installing plugins
}

await installPlugins(plugins, marketplaces);

Or configure git credentials directly:

execSync(`git config --global credential.helper '!f() { echo "username=x-access-token"; echo "password=${token}"; }; f'`);

Environment

• Action version: a017b830c03e23789b11fb69ed571ea61c12e45c (2026-01-16)
• Marketplace visibility: INTERNAL (GitHub Enterprise)
• Runner: ubuntu-latest

Impact

This prevents organizations from using private plugin marketplaces without creating additional PATs, reducing security (more tokens to manage) and convenience.