fix(ci): disable persist-credentials in packagist job#669
Merged
vieiralucas merged 1 commit intomainfrom Apr 22, 2026
Merged
Conversation
actions/checkout@v4 installs a git credential helper that authenticates as the default GITHUB_TOKEN (github-actions[bot]) for all pushes to github.com. That bot cannot push to faiscadev/fakecloud-php, so the mirror push fails with 403 even when PHP_MIRROR_TOKEN is set — the x-access-token userinfo in the remote URL is overridden by the helper's extraheader. Set persist-credentials: false on this job's checkout so git uses the credentials embedded in the remote URL.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v0.10.0 release Packagist job failed with:
Even after refreshing PHP_MIRROR_TOKEN with write on the mirror.
Root cause: `actions/checkout@v4` default `persist-credentials: true` installs a git config extraheader that authenticates all github.com pushes as the built-in GITHUB_TOKEN (github-actions[bot]). That bot has no write on faiscadev/fakecloud-php, so git ignores the `x-access-token:${MIRROR_TOKEN}` in the remote URL and uses the bot token instead.
Fix: `persist-credentials: false` on this job's checkout. The PAT embedded in the remote URL is then used.
Test plan
Summary by cubic
Disable persisted GitHub credentials in the Packagist publish job so mirror pushes use the PAT instead of the default
GITHUB_TOKEN, fixing 403 failures onfaiscadev/fakecloud-php.This restores the v0.10.0 Packagist release flow.
actions/checkout@v4persist-credentials: falseso git uses the PAT in the remote URL, resolving 403 on mirror pushes.Written for commit 0f01b59. Summary will update on new commits.