Restore authenticated ls-remote in signed commit push path

[Copilot]

push_repo_memory regressed after actions/checkout moved to persist-credentials: false: push_signed_commits.cjs called git ls-remote without gitAuthEnv, so auth failed before branch state resolution and execution fell through to unsigned git push (rejected by signed-commit rulesets with GH013).

• Auth propagation fix (runtime path)

  • Updated the network git ls-remote origin refs/heads/<branch> call in pushSignedCommits(...) to pass the same merged env already used by fallback push:
    • env: { ...process.env, ...(gitAuthEnv || {}) }
  • This restores per-process http.extraheader auth without reintroducing persisted checkout credentials.

• Regression coverage (test path)

  • Added focused tests in push_signed_commits.test.cjs to assert that the signed-commit branch-resolution ls-remote call receives gitAuthEnv in exec.getExecOutput(...).
  • Added a guard-style assertion around the ls-remote network call so this omission is harder to reintroduce.

const { stdout: oidOut } = await exec.getExecOutput(
  "git",
  ["ls-remote", "origin", `refs/heads/${branch}`],
  { cwd, env: { ...process.env, ...(gitAuthEnv || {}) } }
);

[Copilot]

Pull request overview

Restores authenticated git ls-remote for the signed-commit push path so branch resolution works when checkout credentials are not persisted.

Changes:

• Passes merged process.env and gitAuthEnv to ls-remote in pushSignedCommits.
• Adds regression tests for auth env propagation to the ls-remote call.
• Updates generated workflow lock files to use DD_APPLICATION_KEY in Datadog MCP headers.

Show a summary per file

File	Description
actions/setup/js/push_signed_commits.cjs	Adds gitAuthEnv propagation to branch-resolution ls-remote.
actions/setup/js/push_signed_commits.test.cjs	Adds focused tests for authenticated ls-remote behavior.
.github/workflows/smoke-otel-backends.lock.yml	Updates Datadog MCP header variable in generated workflow config.
.github/workflows/mcp-inspector.lock.yml	Updates Datadog MCP header variable in generated workflow config.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

actions/setup/js/push_signed_commits.test.cjs:811

• This second test repeats almost the entire setup from the previous test and exercises the same path. The additional toHaveLength(1) guard could be folded into the first test to reduce maintenance cost and avoid creating another full repository fixture for the same behavior.

    it("should include auth env on ls-remote getExecOutput git call", async () => {
      const gitAuthEnv = {
        GIT_CONFIG_COUNT: "1",
        GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
        GIT_CONFIG_VALUE_0: "Authorization: basic test-token",
      };

      const getExecOutput = vi.fn(async (_program, args) => {

• Files reviewed: 4/4 changed files
• Comments generated: 3

[pelikhan]

@copilot review all comments

[Copilot]

@copilot review all comments

Done. I addressed the actionable review feedback:

• tightened the ls-remote tests to assert merged process.env + gitAuthEnv with sentinel checks (9192184)
• removed workflow lock-file churn from this PR scope (c723bd7)

Targeted test run passed: actions/setup/js/push_signed_commits.test.cjs.